A lot of HN readers appear to place the blame on the system engineers rather than the kid. Some go so far as to say that the kid did a good thing in teaching the engineers a lesson. The implicit principle seems to be that unwanted intrusions are acceptable--even applaudable--actions in the face of systems unsecured against them.

I would ask of you whether you would apply this principle in other systems. Shall we call it a "good lesson" if the kid went around shooting people in the train, as a lesson that the trains need to be bulletproofed?

Folks, the criminal law exists to punish certain undesirable actions, so that the general public can save itself the cost of self-protection. I don't walk around wearing a bulletproof vest all the time, because I believe that the law and its enforcement will sufficiently deter others from deciding to intrude upon my body with a bullet.

So should it be with technological intrusions as well as physical. Certainly it is feasible to build secure systems. So is it feasible for me to wear a bulletproof vest all the time. But secure systems, like bulletproof vests, are costly things--they require hiring good engineers, spending time to evaluate security risks, testing systems for robustness, and so on. And if these costs are sufficiently high, then it would be economically inefficient to impose them on systems engineers by allowing hacking like this to go unpunished.

I'm not saying that anyone should be lax in building secure systems. I am, however, saying that intrusive behavior like this kid's should not be applauded. It should be recognized for what it is: a societally detrimental act, for which he should be held accountable as any other societally detrimental act is held under the law.