Let's imagine a decent law that would require people to register what kinds of information they are protecting, from what kinds of use. One kind of security re

Let's imagine a decent law that would require people to register what kinds of information they are protecting, from what kinds of use. One kind of security researcher we would want to protect is the one who finds out they can get information, but doesn't get everything, or doesn't keep what they get, or doesn't get anything really sensitive. Or who establishes that they can modify a system, but doesn't change anything important. If someone gets my credit card number, and doesn't use it, and points out the problem, I want to thank them. We make the analogy of breaking into houses, but bad information security is more like someone putting up a post-it note that says "This is a lock." Sometimes just looking past the lock violates the letter of the law.