http://www.wired.com/2015/05/feds-say-banned-researcher-commandeered-plane/

A couple of weeks ago, I posted a blog entry here about the thin line between a security researcher and “cracker”.  About how the difference between “good guy” and “bad guy” gets blurred by things like corporate bounties for zero day exploits and law enforcement’s ideas on criminal prosecution.  There’s another element to be considered as well.

SPIN.

Here’s the thing.  Whomsoever gets their story out there first has some lead time to shape hearts and minds.  The “Feds” are never EVER going to be first at this.  They don’t GAF about hearts and minds, they care about facts and evidence.  So when they finally speak up, it means they have something that will hold up in court.  This can take months, possibly even years and by the time they finally DO speak up, there’s going to be a sh*tstorm of public opinion to deal with.  So nobody will believe them, because they didn’t put the time in on the PR side.  Because their job is to enforce the laws, not to make you feel all warm and fuzzy while they do it.

But as observers in the court of opinion, we don’t really *know*, do we? Anyone who has been in a tight moral spot can empathize with the researcher, can understand that they might have been stepping outside the box in order to get a security issue taken seriously.  But on the other hand, we have the authorities eventually speaking up and saying “Well, actually…”  Could both sides be lying?  Absolutely.  Could both sides be telling the truth?  After a fashion (once you start getting terminology clarified).

And when we run into a disconnect like this one, this is where our trust breaks down.  This is where we have a step across the line that might be a bit too much too far.  A “white hat” hacker trying to ensure a security hole is fixed, possibly trying to do the “right thing”, but the story as it continues to unfold suggests that the “right thing” put lives in danger.  Not in the “I’m going to take you all down with me Mouhouhahaha” kind of danger, but the “Hey Ma, look, no hands!” kind of danger, where a situation itself is high-risk even if the intentions are benign.

And in the meantime it serves to reinforce the idea that hackers of any color hat are dangerous.  They can lay hands on the keys to the city and cannot wholly be trusted not to use them.  Their own moral compass (or thirst for knowledge, or love of puzzle-solving) may drive them to act for the greater good, circumventing much slower corporate processes but endangering lives (or personal information, or your nest egg) in the process.