More on Brian K. West, DOJ, and "Good Samaritan" prosecution

[Peter Hollings]

I suspect that most IT security managers would initially respond to an
intrusion by turning on programs that would log the intruder's
activities.  To prevent re-occurance, they'd want to know the intruder's
identity, method of penetration, activities, etc.  Also, any form of
prosecution would depend on this.  (See,  for example:
http://www.cert.org/security-improvement/modules/m06.html .)  Thus, the
intruder would likely NOT KNOW immediately that his presence had been
detected.)

The second question, whether someone could "accidentally" intrude on
someone else's computer is more speculative.  In general, people don't
accidentally access, much less penetrate, another computer, but it's
possible, just like it's possible for a legitimate deliveryman knocking
at a door to find that it swings open (because it's unlatched).
Ultimately, I think that the important issues are things like
motivations, damages, knowledge that it was a secure area being intruded
upon, etc.

Peter Hollings

********