# Man arrested exploiting lock flaw to break into hotel room **URL:** \ **Category:** In My Humble Opinion\ **Created:** [December 3, 2012, 12:43am UTC](https://boards.straightdope.com/t/man-arrested-exploiting-lock-flaw-to-break-into-hotel-room/642806 "2012-12-03T00:43:01Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![ducati](https://avatars.discourse-cdn.com/v4/letter/d/cc9497/32.png) [@ducati](https://boards.straightdope.com/u/ducati)\ **Post date:** [December 3, 2012, 12:43am UTC](https://boards.straightdope.com/t/man-arrested-exploiting-lock-flaw-to-break-into-hotel-room/642806/1 "2012-12-03T00:43:01Z")
So, some sunlight averse, snack-food [junkie](http://www.youtube.com/watch?v=JIOnjGihUgg)spends 3 years in momma’s basement trying to crack the code to electronic door locks. Me, I like photography and sporting clays. To each his own. However, instead of telling the vendor in question, or other similar vendors, that a flaw may exist in their product that endangers people, he goes public. Super idea. Enter [knucklehead #1](http://www.nydailynews.com/news/national/texas-man-jailed-allegedly-exploiting-flaw-hotel-room-locks-article-1.1209751). Not necessarily the only person to do this, but just one that got caught. He fashions his own gizmo per the junkie’s instructions, and sets about breaking into hotel rooms. My question for you unfrozen law-talking guys and other educated individuals is this: what culpability, if any, does our troglodyte friend have in this case? What if someone were injured, raped, or killed at the hands of someone who copied Cheeto-boy’s gizmo and gained entry with it? Now we’re all familiar with the Anarchist’s Cookbook and other fun missives that are sold “for entertainment purposes only”, and there’s a hundred kids on Youtube teaching us how to pick locks - your own, mind you - and there’s no liability for them. Should the guy who gives me directions to the liquor store where I then proceed to buy booze, get hammered, and plow through a T-ball game have any liability? No, I think not. I’m the one who drank, drove, and plowed; it’s all on me. Yet, shouldn’t there be some liability here? Surely giving highly technical instructions to commit a crime that is otherwise impossible is more odious than telling someone that the Brinks truck shows up at 3 each afternoon, wink, wink. C’mon law students. Dig in there and find me something with teeth! If Jack Mcoy can always find some arcane law against dogs shedding on Tuesdays, I know you guys can do just as well! ---
**Author:** ![tellyworth](https://avatars.discourse-cdn.com/v4/letter/t/977dab/32.png) [@tellyworth](https://boards.straightdope.com/u/tellyworth)\ **Post date:** [December 3, 2012, 12:56am UTC](https://boards.straightdope.com/t/man-arrested-exploiting-lock-flaw-to-break-into-hotel-room/642806/2 "2012-12-03T00:56:32Z")
The lock vendor and hotels have known about the flaw since July. Several fixes have been available since then. That particular hotel has known about it since at least August. Police have not said how he broke into the room. The idea that he used the exploit is speculation by the hotel. They also claim to have fixed the locks, which contradicts the theory. ---
**Author:** ![jacobsta811](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/jacobsta811/32/2893_2.png) [@jacobsta811](https://boards.straightdope.com/u/jacobsta811)\ **Post date:** [December 3, 2012, 3:48am UTC](https://boards.straightdope.com/t/man-arrested-exploiting-lock-flaw-to-break-into-hotel-room/642806/3 "2012-12-03T03:48:38Z")
I think there should be None/No Liability. The lock vendor’s response has basically been “replace all the locks in your hotel at your own expense- these ones are secure, we super dog swear and you won’t have to do it again”. No surprise most hotels haven’t but if the guy had told the lock makers, the response likely would have been either A) F— off, or B) Oh, hey great, lets sue you to force you to not reveal it. ---
**Author:** ![FlyByNight512](https://avatars.discourse-cdn.com/v4/letter/f/82dd89/32.png) [@FlyByNight512](https://boards.straightdope.com/u/FlyByNight512)\ **Post date:** [December 3, 2012, 5:22am UTC](https://boards.straightdope.com/t/man-arrested-exploiting-lock-flaw-to-break-into-hotel-room/642806/4 "2012-12-03T05:22:18Z")
> [@jacobsta811](#): > > If the guy had told the lock makers, the response likely would have been either A) F— off, or B) Oh, hey great, lets sue you to force you to not reveal it. Yup, that reaction is way, way too common. Contrast Google, who offers a substantial cash prize to anyone who can show them a security flaw in their systems. The idea that knowledge of how to commit a crime and disseminating such information is itself a crime - that really worries me. How is the world supposed to train locksmiths, then? Or computer security experts? (There are way, way more legit computer security people than hackers, unless we’re counting script kiddies.) We’re supposed to punish the action, not the thought. Otherwise it’s like deliberately blindfolding everyone in the idea that it somehow makes us safer. If the guy who found the exploit specifically collaborated with the guy who used it to break into hotel rooms, sure, there’s a criminal charge there. Otherwise, nope. ---
**Author:** ![iamthewalrus\_3](https://avatars.discourse-cdn.com/v4/letter/i/258eb7/32.png) [@iamthewalrus\_3](https://boards.straightdope.com/u/iamthewalrus_3)\ **Post date:** [December 4, 2012, 12:37am UTC](https://boards.straightdope.com/t/man-arrested-exploiting-lock-flaw-to-break-into-hotel-room/642806/5 "2012-12-04T00:37:52Z")
> [@FlyByNight512](#): > > Yup, that reaction is way, way too common. Contrast Google, who offers a substantial cash prize to anyone who can show them a security flaw in their systems. To be fair, the economic incentives are very different. Google can generally fix their security problems by pushing a software upgrade, and finding out about it from some guy who they pay a few $thousand to in bounty is much cheaper than the service outage if a bad guy takes advantage of it. Lock makers may or may not be able to update their locks in the field, and even if they can, it’s probably orders of magnitude more expensive to do it. Plus, they don’t suffer immediate damage from a breach, but they _do_ suffer if the truth gets out. I’m not saying that justifies heavy-handed legal threats. But it certainly demonstrates why they’re favored by companies that have substantial quantities of hard-to-update hardware in the field. I agree that spreading information about how to exploit a system should not be criminal. ---
**Author:** ![Simplicio](https://avatars.discourse-cdn.com/v4/letter/s/c37758/32.png) [@Simplicio](https://boards.straightdope.com/u/Simplicio)\ **Post date:** [December 4, 2012, 3:50am UTC](https://boards.straightdope.com/t/man-arrested-exploiting-lock-flaw-to-break-into-hotel-room/642806/6 "2012-12-04T03:50:25Z")
> [@ducati](#): > > So, some sunlight averse, snack-food [junkie](http://www.youtube.com/watch?v=JIOnjGihUgg)spends 3 years in momma’s basement trying to crack the code to electronic door locks. Me, I like photography and sporting clays. While he does look like he hits that snack food a little harder then he should, [the guys been](http://en.wikipedia.org/wiki/Cody_Brocious) pretty productive for his age. I doubt he lives in a basement, his mothers or otherwise. But in any case, I agree with the other posters. The guy has no legal or moral responsibility for the break-in. ---
**Author:** ![Max\_Torque](https://avatars.discourse-cdn.com/v4/letter/m/e9bcb4/32.png) [@Max\_Torque](https://boards.straightdope.com/u/Max_Torque)\ **Post date:** [December 7, 2012, 8:25pm UTC](https://boards.straightdope.com/t/man-arrested-exploiting-lock-flaw-to-break-into-hotel-room/642806/7 "2012-12-07T20:25:47Z")
Note the very old case of [**Hit Man: A Technical Manual for Independent Contractors**](http://en.wikipedia.org/wiki/Hit_Man:_A_Technical_Manual_for_Independent_Contractors). Long story short: a man hired a guy to kill his wife. The hired killer got information on how to commit and cover up his crime from the above-named book, published by Paladin Press. The estate of the deceased sued Paladin, saying that by publishing the book, Paladin intentionally aided the killer in committing the crime. Now, here’s the interesting part, quoting the case itself: > [@](#): > > Paladin… has stipulated for purposes of summary judgment that Perry followed the above-enumerated instructions from **Hit Man** , as well as instructions from another Paladin publication, **How to Make a Disposable Silencer, Vol. II** , in planning, executing, and attempting to cover up the murders of Mildred and Trevor Horn and Janice Saunders… Paladin has stipulated not only that, in marketing **Hit Man** , Paladin “intended to attract and assist criminals and would-be criminals who desire information and instructions on how to commit crimes,” … but also that it “intended and had knowledge” that Hit Man actually “would be used, upon receipt, by criminals and would-be criminals to plan and execute the crime of murder for hire.” … Indeed, the publisher has even stipulated that, through publishing and selling **Hit Man** , it assisted Perry in particular in the perpetration of the very murders for which the victims’ families now attempt to hold Paladin civilly liable… So, Paladin essentially _admitted_ that they aided the killer in committing the crime, but still claimed that they were not liable because, hey, free speech. The court disagreed, saying that speech is not protected if it is intended to aid in committing a criminal act. It appears to me that Paladin attempted to test the limits of the First Amendment and got burned for their arrogance. I very much doubt that the outcome of the case would have been the same if Paladin hadn’t made their extensive stipulations. If they’d just said, “Hey, this book is for entertainment and crime novel writers, not actual killers!” they probably wouldn’t have been found liable. The lesson from all this: intent is key. “key”. snicker. ---
**Author:** ![pravnik](https://avatars.discourse-cdn.com/v4/letter/p/8edcca/32.png) [@pravnik](https://boards.straightdope.com/u/pravnik)\ **Post date:** [December 7, 2012, 8:36pm UTC](https://boards.straightdope.com/t/man-arrested-exploiting-lock-flaw-to-break-into-hotel-room/642806/8 "2012-12-07T20:36:13Z")
Darnit, beaten to the punch on Hit Man and Paladin Press! ---
**Author:** ![Blaster\_Master](https://avatars.discourse-cdn.com/v4/letter/b/cab0a1/32.png) [@Blaster\_Master](https://boards.straightdope.com/u/Blaster_Master)\ **Post date:** [December 7, 2012, 10:42pm UTC](https://boards.straightdope.com/t/man-arrested-exploiting-lock-flaw-to-break-into-hotel-room/642806/9 "2012-12-07T22:42:38Z")
He should have absolutely no liability. Not sharing that information, particularly under threat of the manufacturer, is what I like to call security through ignorance. Sure, he’s a good guy and won’t do anything with it, but that he found it out means someone with more nefarious intentions very well may soon after, if he hasn’t already. It may cost that company money by exploiting a weakness in their design, but it also allows them the opportunity to correct for it. Further, it allows people who may depend on their locks to be aware of the risk and appropriately take that added risk into account. Yes, it’s a lot cheaper if it’s a software exploit rather than a hardware one, but that’s part of the risk of the business.