united-kingdom internet computer-misuse-act
Accessing Internet Connected Devices with Default Credentials
<p>In a world of ever increasing numbers of internet connected devices people are having more and more of their appliances exposed to the outside world: cameras, fridges, thermostats etc. </p>

<p>Many of these are left with the default passwords enabled and are easily searchable on websites such as Shodan.</p>

<p>My question is this, is it legal to access such a device for the sole purpose of determining if the default credentials have been used so that you can alert the owner of this security vulnerability?</p>

<p>For instance: by default, a Raspberry Pi has SSH enabled with the login <code>pi</code> and password <code>raspberry</code>. </p>

<p>I'm particularly interested in the take on this in the UK and any precedents.</p>

<p>In almost all jurisdictions unauthorised access to a computer is against the law. In most of these the definition of "computer" is sufficiently broad to encompass anything with WiFi access and unauthorised means without the owner's permission.</p>

<p>Using a default password is similar to using a default code on a combination door lock - it's really foolish <strong>but</strong> it's still a legal signal that access beyond it is unauthorised.</p>
