In the US, the law is written in defense of the host. The attacker is considered at fault for breaching a system that they are not supposed to have access to. F

In the US, the law is written in defense of the host. The attacker is considered at fault for breaching a system that they are not supposed to have access to. From the CFAA(a)(2)(C)[1]: >Whoever... intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains... information from any protected computer; The spirit of this law is fine: security is notoriously hard to get right. We have to account for the human component that will inevitably fudge something. Thus companies that give reasonable attempts at securing their data yet still fall short in certain areas are still protected under the law. Conversely, companies that don't care are also protected due to the letter, rather than the spirit, of the law. [1]: https://www.law.cornell.edu/uscode/text/18/1030#a_2 https://www.law.cornell.edu/uscode/text/18/1030#a_2