To some extent, I disagree. It can set a pretty high de facto bar especially for the independent researcher. Sure,
eventually -- if the world and the court you land in are a fair and decent place -- you may be absolved. But you may spend
a lot of time and money getting to that point.
Facing what appears to be frequently very if not overly aggressive government prosecution, and/or private prosecution (so far, civil -- although see e.g. privately driven criminal prosecutions in the U.K.) by very well funded, perhaps overwhelmingly funded legal teams motivated by parties who as often as not seem to want to bury any and all bad publicity while discouraging any efforts that might -- even when justifiably -- dig it up...
I guess I view the top level Internet IP address space as a public space. If you can't put onto and manage your resources on it in a responsible and secure fashion, you deserve what you get.
Going from memory, as I understand it, there was no "subverting an authentication system", here. He merely iterated a public parameter. Granted, he apparently stepped through a lot of iterations, but a script can do that, even inadvertently, as IIRC was alleged to have occurred in this instance.
Ultimately, he didn't sell or otherwise misuse the resulting data. My personal inclination would be to argue that at a minimum, benefit of the doubt should mitigate against a felony-level conviction.
Also personally, my own dealings with AT&T have left me with absolutely no sympathy for them. The SBC culture from which their senior management devolves I have found to be atrocious.
They should spend less time looking for scapegoats to fry and wave in front of the next person to find one of their shortcomings, and instead "man up" and fix their own processes and systems.
Finally, in many such cases, it does seem to be the individual who is finding these problems and therefore causing them to be fixed. As the holder of online accounts and data, I don't want to abandon that field to some combination of lackadaisical corporate process along with un-prosecutable malicious entities in Eastern Europe, China, or wherever.
I know you're the expert in this field. And I don't mean to disrespect your work nor your commitment to excellence. Nonetheless, my own not insignificant experience has shown me repeatedly and taught me how, absent independent pressure, entities often don't get around to fixing such problems and can actually create de facto strong internal disincentives to doing so. I've seen this, repeatedly and at many organizations including very large and successful multi-national firms, myself.
I've seen it from the inside, where I've had to take damage and career risks in order to get things addressed. Even as a well-meaning employee of an organization with such a problem, I worry what "doing the right thing" may cost me.
We are increasingly forced to rely on them -- banking records, medical records, etc., etc. The onus should be on them -- to get this right. If nothing else, I can argue that economically it is they who can afford the risk (that is, the responsibility and cost of pro-actively mitigating it). And that should be a factor that is considered when determining where the balance in the law rests.
One argument that I've seen made, is that European credit and debit cards have chip and pin because the European banks bore a greater risk for and cost of fraud. Economic incentives can be an important factor in creating and maintaining security. Criminal risks can be, as well, but perhaps in a different fashion than we are talking about for this case. For both the economic and the criminal liability, the weight needs to rest more heavily on the parties blatantly leaving personal data vulnerable.
Such entities seem to demand ever more of the resources society has at hand -- financial, legal, etc. They should bear the responsibility, along with this. If one guy and his laptop can catch them out, and particularly if he's not doing evil with the results, well, then, shame on them. Stop focusing so much on "the hacker".