James Button

London

Consultant

So, how did the CSO's know he was using a computer/web connection ?
How did they know it was unsecured?
How did the know who was providing that connection facility ?
Has the provider complained about the use of the provided service ?
Has the providers ISP taken action against them for providing that connection as an unsecured facility for others outside the contractual limitations to use that contracted limited facility ?

Personally, I waould say that no one should be prosecuted for using inappropripriately secured facilities unless the person who failed to provide/implement/use the appropriate security is also taken to task for that breach.

(And - for the USA government bodies such as the FBI, CIA, etc. - note leaving mainframe master login and passwords as SYSTEM/TEST, or Administrator/password should be treated as a clear breach of such requirements, resulting in the prosecution and incarceration of those charged with the control of such systems, and the management who should have ensured that those staff were doing their job properly!)