Can it be illegal to press f12 in a web browser?

Question

There is a case in the news where a journalist identified a security issue in the web site of the Missouri Department of Elementary and Secondary Education that exposed 100,000 social security numbers. He did this by viewing the source of the page, using the f12 hotkey or right-click and selecting "Inspect" or "View page source" depending on your browser. When he made this discovery he disclosed the vulnerability to the DESE, and delayed publishing an article on the discovery until the department removed the vulnerability and worked to find if any other related sites and applications contained similar vulnerabilities.

The response of the Missouri Governor Mike Parson was to accuse the reporter of hacking under Section 569.095, RSMo. While the County Prosecutor has announced no charges would be filed this has involved four months of harm to the individual and their family and the Governor maintains that Renaud had unlawfully hacked the school website.

A somewhat similar case is the 2017 case of the Hungarian teenager who identified a bug in the Budapest Transport Authority (BKK) website that allowed anyone to set the price of a ticket. He demonstrated the flaw by buying a ticket, and told the BKK by email. He was arrested. He lived outside of Budapest and could not use the purchased BKK pass.

There are four aspects that seem to me could give rise to legal risks, but I have no idea if any could reasonably give rise to successful charges in cases such as this:

• Use of developer tools on third party web sites
  • The developer tools in modern browsers are very powerful tools. One illustration of this is to select the "Debugger", and the "Pause on any URL". This gives one a view of the activity of many web sites that is not intended by the developer, particularly those using the cloudflare tools. It also produces a human readable version of minified javascript, which is produced to be machine readable. This is not decompilation as javascript is not a compiled language, however functionally it is like applying a java decompiler to a java web start application for example. I think it has been claimed that the DMCA can criminalise decompilation, could such a law be used in this case?
• Decoding the data within the web site
  • As I understand it the SSN's were encoded in Base64, whereas the rest of the website was another encoding (ascii?). This may have involved a separate tool to be identifiable as an SSN, but may well not as javascript includes the functionality (the function atob()) and many developers can do a rough job in their heads. Is it possible that one can commit a crime by inappropriately decoding strings in common formats, perhaps even in your head?
• Handling of potentially erroneously exposed PII
  • If one comes across personally identifiable information (PII) on the internet I would assume there are things you can do that are illegal. I am not sure what they are, but I do know that the accepted way to handle security issues in software is to inform the organisation responsible and wait an appropriate time before publishing the issue. This is roughly what the reporter did in this case, but are there any specific legal measures that one can take in such situations to ensure one is not breaking any laws?
• Fraudulently gaining something
  • If one actually exploited a software error to get a material benefit, such as cheap transport, it seems that one could be committing fraud. If one makes a purchase to demonstrate a flaw and tell the organisation about it without making use of the purchase can this be illegal, or does one need to intend to actually gain a benefit?

Any jurisdiction would be interesting, particularly any that has actual case law of such actions being found to be illegal.

Answer 1

The law is really bad at protecting whistleblowers

From my understanding of US law, this is not unauthorised access to a computer: the reporter made a legitimate request to a remote computer, that computer provided data,the reporter accessed the supplied data on their own computer.

However, pointing out the failures of people in power is fraught even if it is not illegal.

It is certainly within the Governor’s power to authorise an investigation of the reporter. On the face of the law, it seems reasonable to suspect that what was done might be a violation so there is nothing legally wrong with initiating an investigation. I suspect that such a broad interpretation of the law would fall foul of the First Amendment which may partly explain why it wasn’t prosecuted: the government doesn’t want to find out.

Similarly they can issue press releases, which, due to the First Amendment, don’t have to be true, just not defamatory. Saying it’s a possible violation is true and not defamatory. Saying the reporter was an evil person who is only doing this for political purposes is a statement of opinion and not defamatory.

It’s a fact of the world that people with power can use that power in ways that are malicious, unethical, and unfair but not necessarily illegal.