Swedish city demands £40,000 to repair teenage hacking spree

I think I read in a local article that he actually tried to warn them first, but they didn't listen to him, and that's why he decided to show them. Don't know if that is actually true or not though.

Surely they should be sacking whomever is in charge of their system security and hiring this guy as a consultant to his replacement, assuming he doesn't want the job himself?

Passing on the bill for proper security to the guy that pointed out what you had wasn't worth shit seems unfair. People have very little choice about allowing the state to hold whatever data they please about us. The minimum we're entitled to expect is that it'll be kept securely, and that there will be consequences when its not (lessons are only learned once heads have rolled).

We know our system is secure because nobody points out any faults.

If anyone does point out any faults, we sue them.

See? Nobody points out any faults.

What could possibly go wrong?

Still fair compared to other countries...

35 hours community service and a 5-digit bill for breaking into local authority websites isn't that harsh at all. Let's not forget that what he did is still illegal.

In other countries, especially on the other side of the big pond, he would have been locked away for a long time, paying compensation in the millions, and possibly be branded a terrorist for good measure...

My 2p on this...

If the kid told them, before the hack, that "x" exploit was open, but they ignored him and did nothing, with a reasonable fix time, then they have been negligent and in my opinion, should be liable for their own security costs. (Bearing in mind, the kid does now have a criminal conviction over and above their sueball.You can't sue a burglar for the cost of a security system, after leaving your windows open.)

If however, this was a straight black hat hack, then yes, he should be liable.

It doesn't state if this was the case or not.

And this is why you always alert people anonymously - a lot of people with power like to shoot the messenger when they don't like the message.

This is precisely the problem...

...failure to impose a deterrent to hacking. 35 hours community service is an insult when this person could have just told the appropriate people why he believed they system was insecure instead of actually hacking it. Proof of concept could be done by the authorities. The kid should at least pay the damages and be held accountable for hacking - which 35 hours community service is not.

The original article states, that it is not the first time he is charged with hacking, and that he repeatedly have tried to make the it department aware of the lack of security

Furthermore, there is a quote from the judge, that the documented warnings will have no impact on the verdict.

Nice work, there is a bloke who will never warn anybody of anything again.

:(

Here is what this sounds like to me, by telling a story that I think equates to what happened.

You are walking down the street and pass by a local police building. It's got a nice architecture so you go to take a closer look. You see, via a window, highly sensitive investigation files, right in view of anyone who could walk up to the window, like you just did.

You walk in the front door and tell the officer on duty "Hey, I was passing by and noticed someone doing an investigation is leaving the files in plane view of the third window on the right from the door, you guys should be more careful."

Then the cops reply "Sir, you're under arrest for breaking into police property and damaging the building security. Pay up a huge fine so we can install automatic curtains that stay closed at all time on the windows so it doesn't happen again".

Yea ... the public is no longer allowed to point out incompetence in the gouv. That will never go wrong ...

Fine for the firm?

What fine does the firm have to pay for storing passwords in a non-encrypted format?

What fine does the firm have to pay for not bothering with any type of security on personal data?

If this kid has to pay 40k, then I'd think the firm out to be hit with about a 4m one. Seems fair to me.

40k

They should get fined by the ICO for a breach and potential loss of data perhaps 200k just to make the point that security is their problem and that suing a white hat hacker is just going to give every black hat hacker the green light to hack them because they don't take security seriously.