@Theo From the description in this article, your analogy doesn't relate. Do we know that he did anything but "turn the handle of the door" (to use your analogy)? All too often computer security breaches are covered up and not ever properly fixed. When I have submitted evidence of a security flaw, I have always checked later to make sure measures had been taken to remedy the situation.

Think of it this way:

me: "Hey, I know you just armed your security system, but did you know that there is a big hole in the back wall and people can just walk into the house?"
you: "Oh, great. I will fix that. Thanks"

some time later:

me: "Hey, I was in my back yard and I see that there is still a giant hole in your wall. Are you planning on fixing that?"

Was I wrong to notice? In this case, it is your property, so you can do what you want; fix it or not. In the case at Dawson, the student likely felt a shared responsibility in protecting the school from the security flaw. In that case, I would have felt an obligation to follow up and make sure the school "plugged the hole". If the school fixed it, that's great. If the school didn't, they are negligent. Your house is your private property. He was using an information system meant for use by both students and the public. His concerns about the protection of his, and others', information are completely valid.

What seems to have happened here is something like the following:

me: "Hey, I checked again and the giant hole in your wall is still there."
you: "You aren't supposed to be looking at my wall. In fact, I'm calling the police because you were looking into my private space; my house, without my authorization. You should move, and never come back"

Seems a little harsh, doesn't it?

The line between "public" and "private" is very undefined in the digital world. Unless there are clear security measures in place to impose a line, there is no line.

Listen to the audio. There is nothing wrong with what he did. His approach seemed very reasonable and professional. There seems to be everything wrong with how Dawson reacted to a valid verification of their fix.

I'm very glad to see that Mr. Al-Khabaz is now being courted by security firms instead of ending up in court.