> Although rarely listed as an element, the common law required that "entry occur as a consequence of the breaking".[7] For example, if a wrongdoer partially opens a window with a pry bar—but then notices an open door, which he uses to enter the dwelling, there is no burglary under common law.
There are more results if you search for "breaking and entering", it was all pretty consistent.
Reading that WP article again, turns out I was just considering the common law part. It later says:
> The common law definition has been expanded in most jurisdictions, such that the building need not be a dwelling or even a building in the conventional sense, physical breaking is not necessary, the entry does not need to occur at night, and the intent may be to commit any felony or theft.
So I'll give it to you for "physical breaking is not necessary", even though I don't actually know about the jurisdiction in question. (I didn't rtfa.)
I don't see how you could access a computer without using "force", any input from a human constitutes force in my opinion. So no disagreement as far as the actual crime is concerned, I'm just nitpicking for fun...
You can walk into a house through an open door,
but you can't walk into a computer.A failure to change the locks does not mean you have created an attractive nuisance to former employees.
However, failure to collect keys get's into murky situations.
If a lessor or landlord in Illinois does not change or rekey the unit's lock before the day the new tenant or lessee takes possession, and a THEFT occurs at that dwelling unit that is attributable to the lessor's failure to change or rekey the lock, the landlord is liable for any damages from the theft that occurs as a result of the lessor's failure to comply with the law http://www.securitydepositlaw.com/blog/chicago-tenants-right...
But stipulate that it was true. What bearing does that have on this case? If I go into that office and steal $5000 worth of computer equipment, am I not liable for felony grand theft because the landlord has civil liability to the tenant?
Granted, this does not apply in your case, but Chicago does have mixed use Residential/Commercial leases which is covered.
Now suppose a tenant goes back to retrieve their property the day after there lease ends. Which under some situations they are allowed to do. Key works, the enter building...
IANAL, but would suggest this is a situation the owner would like to avoid.
But there is no sense in which that kind of liability mitigates the criminal actions of others. If I go into a building for which the landlord is liable for theft, and I steal $5000 worth of crap (or cause $5000 worth of damage), I'm going to be prosecuted for that if I'm caught, no matter the landlord's liability. Criminal liability isn't shared due to negligence, and when criminal liability is shared (among accomplices and co-conspirators), it's not divided up among the parties --- because that would be silly.
But, they can't claim time related to revoking his permissions because they should have done that in the first place. Ditto for performing a security audit ect.
This is a normal user using there CMS system, not an admin or developer messing with things.
If you're objecting to the idea that, having caused a breach, the convicted attacker is now on the hook for securing the application they broke, so that the attack they used is no longer viable, I agree. That is in no way fair.
But that's not what's happening.
Instead, having been breached, and only because they've been breached, the victim is now in a position of needing to assess the extent of the damage done. They can't guess --- at least, not if they're a major corporation --- because continuing to operate when you have reason to believe you've been systemically compromised is unethical and dangerous.
That's the difference between a DF/IR audit and a security audit. A security audit tries to find all your vulnerabilities. A DFIR audit tries to scope the compromise and retain evidence. Of the two, the DFIR audit has a narrower scope and more specific purpose.
But, weirdly, it's also more expensive. There are more application security consultants than there are DFIR auditors, and DFIR auditors are often selected by insurance companies, not by the market.
At any rate: the costs we're talking about Keys having incurred are not a bonanza of free assessment work Trib gets to bill to Keys.
I accept that you feel an external audit is required. But, is it a reasonable expense directly incurred, no.
PS: As a parting piece of evidence. Was $10,206 to $13,147 likely to include DFIR audit and all other costs? No.