united-states hacking ethical-hacking computer
Legal implications of printing something remotely to tell the owner their printer is vulnerable?
<p>Commonly, wireless printers in homes and corporate settings can be configured incorrectly, exposing them to the internet. This can be a major security vulnerability, and can allow anyone to not only print stuff remotely on it, but sometimes even get full access to the network it's connected to.</p>
<p>If somebody happens to find a vulnerable printer online, and no contact information associated with it, would it be legal to print a message on it to let the owners know that it's vulnerable, and possibly even how to fix it?</p>
<p><strong>Edit</strong>:</p>
<p>Usually, these printers are configured not to have any sort of password, or anything really, preventing access from anyone on the internet. The printer also has to be manually set up to allow access from the internet, so could that technically be considered permission to access the device?</p>

<p>This could be a violation of <a href="https://www.law.cornell.edu/uscode/text/18/1030" rel="noreferrer">18 USC 1030</a> (and a crime). A number of things go into requirements for conviction under this law. First, it has to be a computer, which is defined as</p>
<blockquote>
<p>an electronic, magnetic, optical, electrochemical, or other high speed
data processing device performing logical, arithmetic, or storage
functions, and includes any data storage facility or communications
facility directly related to or operating in conjunction with such
device, but such term does not include an automated typewriter or
typesetter, a portable hand held calculator, or other similar device</p>
</blockquote>
<p>Any printer that I have encountered in the past 40 years counts as &quot;a computer&quot;. Second,</p>
<blockquote>
<p>(2) intentionally accesses a computer without authorization or exceeds
authorized access, and thereby obtains—...(C) information from any
protected computer;</p>
</blockquote>
<p>It is highly likely that the person printing has to receive some information from the printer, and respond accordingly so you have your &quot;obtains information&quot; element. Maybe not useful information, but information nevertheless. It also has to be a <em>protected</em> computer,</p>
<blockquote>
<p>(B) which is used in or affecting interstate or foreign commerce or
communication, including a computer located outside the United States
that is used in a manner that affects interstate or foreign commerce
or communication of the United States</p>
</blockquote>
<p>Well, a computer connected to the internet is a protected computer, see <a href="https://casetext.com/case/us-v-trotter-11" rel="noreferrer">US v. Trotter</a>, 478 F.3d 918. Also, the access must be &quot;without authorization or exceeds authorized access&quot;. The law doesn't explain with &quot;without authorization&quot; means, but the latter is defined as</p>
<blockquote>
<p>to access a computer with authorization and to use such access to
obtain or alter information in the computer that the accesser is not
entitled so to obtain or alter</p>
</blockquote>
<p>If the law were stated in terms of &quot;prohibited access&quot;, meaning &quot;express denial of permission&quot;, and if the computer owner had set the computer to &quot;prohibited access&quot; by default (password protected), there would be no issue -- accessing the computer is prohibited. &quot;Unauthorized&quot; can also mean &quot;has not been explicitly authorized&quot;, i.e. lacking any indication one way or the other. <em>Every</em> computer access is initially unauthorized, until authorization is granted; and re-trying a login after mis-typing a user name (and being denied access) is not a violation of this law.</p>
<p>There does not appear to be case law that addresses the status of computers just left open to the public, and whether using a computer that is so exposed constitutes &quot;unauthorized access&quot;. Also, it is not clear that the defendant in this case has &quot;obtained information&quot;, since with printing, information flows <em>into</em> the computer. There is also a clause about recklessly causing damage, but I don't see what damage would result (&quot;damage&quot; is defined as &quot;any impairment to the integrity or availability of data, a program, a system, or information&quot;), and how printing would be &quot;reckless&quot;. It seems somewhat unlikely that this would be deemed to be a crime, though if you experiment, you could be on the cutting edge of new case law.</p>
