From what I understand (IANAL), the bar for what constitutes criminal activity with computers is very, very low. As in, arguably the recent post by Julia Evans on undocumented web APIs[1] is a tutorial on performing criminal acts.
Which is not a judgment on whether LAPSUS$ is doing genuinely bad stuff—I don’t know—only to say that, when computers are involved, “criminal” not only doesn’t make a good consensus point on avoiding a slippery slope into overall badness, it doesn’t even seem to make a good heuristic on whether something is bad or not.
Generally speaking hacking is unauthorized computer access.
More specifically hacking under US law is;
Californian law for example:
1. Knowingly accesses and without permission alters, damages, deletes, destroys, or otherwise uses any data or computer system to:
2. Execute a scheme to defraud or extort a victim.
3. Wrongfully control or obtain money, property or data.
4. Knowingly accesses and without permission takes, copies, or makes use of any data from a computer or takes or copies supporting documentation.
5. Knowingly introduces any contaminant or virus into any computer system.
6. Knowingly and without permission uses the Internet domain name or profile of another individual, corporation, or entity in connection with the sending of electronic messages that damage a computer system.
7. Knowingly and without permission disrupts or causes the denial of governmental computer services.
8. Knowingly and without permission disrupts or causes the denial of public safety infrastructure computer services.
US Federal Law:
Knowingly accessing a computer without authorization to obtain:
Financial information
Information from a governmental department or agency
Information from any protected computer with the intent to defraud
Knowingly causing the transmission of a program, information, or code from a protected computer
Knowingly accessing a protected computer and causing damage and loss to that computer
Which is not a judgment on whether LAPSUS$ is doing genuinely bad stuff—I don’t know—only to say that, when computers are involved, “criminal” not only doesn’t make a good consensus point on avoiding a slippery slope into overall badness, it doesn’t even seem to make a good heuristic on whether something is bad or not.
[1] https://jvns.ca/blog/2022/03/10/how-to-use-undocumented-web-...