Did you read the article? He was arrested for stealing 900 social insurance numbers from CRA (Canada Revenue Agency, Canada's IRS).
Odds are the insurance numbers are just some of the things that passed through while he performed the hack, or the first thing he saw when he got in. Not something he intentionally took for his own gain.
Even if he was not looking for anything in particular, or did not plan on using any of the information found in the papers, he's committed a felony.
In this case I don't think it's clear whether or not he went ahead to parse out the insurance numbers and save those separately, and if so if he planned to do anything further with those (like sell them).
However, my understanding of heartbleed is it can take many thousands of requests before interesting / meaningful data is returned. I doubt 900 SINs were returned in a single response (I could be wrong). So I suppose this is analogous to repeatedly sticking your head in & out of the wide open window at street-level.
So what I am curious about is where the line is drawn. Is one malicious packet considered enough for an arrest? 1 million?
He knew he was hacking the CRA when he did it. He can't claim to have done it accidentally. The CRA did everything reasonable to secure their servers.
That said, he's a smart teenager playing with technology and did something he shouldn't have. As long as no one was harmed, and his intentions were just curiosity, I think he should get off pretty light. Hate to see his life ruined.
But you can't deny he hacked the CRA. He did.
Let's say on a lark you go walking down the street trying doorknobs, open the first unlocked one, and sit down on the couch and watch TV until the owner gets home. You have trespassed, and if the owner presses charges you will most likely be punished. However, that punishment will most likely be commensurate with the severity of the crime, not life-altering years in prison.
The OpenSSL thing is very much like suddenly discovering you had a street level window open for the past two years.
If he simply ran the Heartbleed script for an hour or 2 and did literally nothing else after it finished running, then yes, your analogy is the correct one and mine is wrong. In that case he should probably only be liable for the money spent by the agency in investigating the attack.
If he scraped out the SSL private key from the results, that's clearly worse.
If he additionally scraped out everything that fit the format of an insurance number, then it's quite a bit worse.
If he planned on publicizing or personally using any of these, then it's far worse.
I would also argue that it's less like a window being left open, but rather a door located around the back of the building where no one goes accidentally being left unlocked.
I do concede that the proper analogy isn't something so plainly visible to all as an open window, but it does have to incorporate an external motivating factor to try the door (perhaps a rumor floating around town that they tend to leave it unlocked and oh boy you wouldn't believe what's on the other side..)
insurance numbers + arrest = canada
mumsnet + posting warning = uk