Jail Looms for Man Who Revealed AT&T Leaked iPad User E-Mails
Jail Looms for Man Who Revealed AT&T Leaked iPad User E-Mails — The case highlights a troubling disconnect between online life and the rule of the law. — AT&T screwed up in 2010, serving up the e-mail addresses …
Context & Ripple Effects
The arc runs back to June 2010, when AT&T confirmed that its servers had served up iPad users' e-mail addresses to anyone who guessed device IDs — the company's own explanation of the breach framed it as an oversight, not an attack. The researcher who publicized the exposure has now been convicted, with this week's guilty verdict leaving him facing prison for disclosing what AT&T itself admitted leaking.
First-order effects
- Andrew Auernheimer moves from defendant to likely inmate: the conviction converts a 2010 disclosure about AT&T's iPad data exposure into a criminal record with a pending sentence.
- AT&T escapes this case without penalty for the underlying leak — the legal cost lands entirely on the person who found and published the flaw.
Second-order effects
- Security researchers weighing whether to report carrier-level flaws face a new calculus: the AT&T outcome shows disclosure can carry personal criminal liability even when the company confirms the leak was real.
- Carriers and device makers gain leverage in how they respond to outside findings — prosecuting the finder becomes a precedent other companies can cite when handling their own embarrassing exposures.
Third-order effects
- If the pattern holds, vulnerability research migrates toward anonymous or offshore publication, weakening the coordinated-disclosure channel that vendors rely on to fix flaws before exploitation.
- The case sharpens a structural question for Congress and courts: whether decades-old computer-crime statutes should treat unauthorized access to publicly served data as a felony, a tension the article itself frames as online life outpacing the rule of law.
The trend: Prosecution of researchers who expose corporate data leaks is chilling the disclosure norms that previously let companies hear about their own security failures first.