alt Hacker NewsThat's a good question. But it is a very fine line between being a white hat that reports a vulnerability in good faith and someone who actually exploits that vulnerability and turns a vulnerability report into an actual breach. This is - in my opinion, clearly the HN hive mind disagrees - across that line.
For instance, if I run into a server and I see 'passport.jpg' in a directory listing I could download it to see if it really is a passport. But at that point in time I am flirting with becoming a defendant in a data breach rather than that I'm reporting a possible vulnerability. Sure, you could argue that the site owner might close the hole and then they could downplay that it really was a passport photograph. But I care more about the hole being closed than that I care about the contents of the file, which clearly are not meant to be disclosed based on the filename alone.
Independent researchers that are under contract with the companies they review sometimes have more leeway in what they are allowed to do. But downloading enough data to be able to run statistical analysis using LLMs is turning this into a reportable breach and that is a great way to get this whole thing to backfire, possibly to the point where the OP turns defendant.
One thought might be - did they
the article mentions "we retrieved only parts of the datasets rather than downloading them in full", so a charitable interpretation might be that for each identified source candidate, they spot checked (or had a model spot check) a few individual records to have incontrovertible proof of breach of privacy, and then ran an aggregate count query to gauge the extent of breach. I think that would be fairly in line with "white hat" behavior that's doing the smallest amount of extra work towards a solid proof and clearly not taking the obvious and easy next step of downloading the remainder that would be required for self enrichment. Difficult to argue that there is an intention of malice.
A bad actor would be downloading /all/ the data and disclosing it to no one, and selling it while obscuring the source.
That said I agree that that certainly might fall afoul of the letter of whatever local laws apply, and certainly prosecutors can also be over-zealous in their interpretations. So personally I would never risk doing something that comes up against that line, from a personal risk POV. But idk if it's fair to argue that this is NOT good faith.