No criticism because teenagers do dumb things, but for anyone else it should be assumed that if you break into a system without permission, benignly or not, you run the risk of getting prosecuted for it.
Threat of prosecution can come even without breaking in. Vengeful and ignorant people will always be a thing. [1]
Missouri's governor threatened legal action against a reporter who found SSN were being leaked on a public web page accessible simply by clicking "View Source". The reporter "followed standard protocols for disclosing and reporting on the vulnerability, the governor is treating him as if he attacked the site or was trying to access the teacher’s private information for nefarious purposes" .
This pisses me off on so many different levels. The reporter told proper authorities and gave them time to fix it before he made the information public but MO's jack-wagon of a governor tried to pin blame on the reporter.
Threat of prosecution is of course always present, but the chance of that prosecution making it past the courts is significantly altered by actually committing the acts you might be accused of.
After reading your story, the image at the bottom stands out. I never thought about the fact that you can’t really trust that what is returned to you is the same as what they took. No telling if they added any malware to those drives intentionally or not.
I vaguely recall this case. I sure hope police have become more cyber literate in the past 10 years, but yeah this is the virtual equivalent of leaving fingerprints on the crime scene.
