Techcrunch comment - http://m.youtube.com/watch?feature=youtu.be&v=q000_EOWy80&de...
Says alternately that he's taken 100,000+ user records, or just 73 Apple worker records, or no user details at all. And that he's keeping all the "evidences".
Downloading 100k userdata records seems quite extreme, but is it unethical for a security researcher to do so?
It usually doesn't protect you even if you don't take anything.
That's why there's a huge backlash against "responsible disclosure".
He refers to Facebook's whitehat list too. Facebook does allow people to try to break parts of their application if they're responsible about the disclosure. To my knowledge Apple doesn't have such a policy so can't have given any implied permission to attempt to attack them.
I don't know the full details of the case but didn't the hacker weev get imprisoned for downloading 100k user records from AT&T?
I think part of weev's downfall was the subsequent conversation he had discussing what he could hypothetically do with the data though.
That likely depends on the laws of the country he was in when the incident occurred.
What really matters in cases like these is whether the country in question will arrest and extradite the individual to the US - this is far less clear cut - see the Snowden case for an example of someone attempting to evade US extradition law.
Some countries (notably China) have been fairly opaque from a US judicial perspective - see hacks on Google, the New York Times blamed on the Chinese - which have ended up with no visible action.