Dejan Ornig, a 26-year-old student at the Department of Criminal Justice and Security in Maribor, Slovenia, was given a 15-month suspended prison sentence this week and will not go to prison unless he repeats his crime within the next three years. Specifically, Ornig's crime, according to local news website Pod Crto, was that he found and then publicized security issues in the state-developed TETRA encrypted communications protocol.
TETRA - the encrypted communications protocol - is used by the Slovenian police, but also by some parts of the army, the Slovenian Intelligence and Security Agency (SOVA), the prison administration and even by some bodies in the financial management departments.
The student began his work investigating TETRA in 2012, as part of a school project with 25 other fellow teachers. By September 2013, Ornig discovered that Slovenian authorities had misconfigured the TETRA protocol.
The protocol, which was designed to encrypt sensitive communications, was sending sensitive data over the Internet unencrypted about 70 percent of the time.
After a responsible act of disclosure, the student informed the police of his findings. Seeing that the authorities were not taking any action, Ornig made his findings public in March 2015.
While employees fixed the TETRA encryption issues, they accused Ornig of attempting to hack their network on three separate occasions, in February, March, and December 2014.
Officials also conducted a search of his home a month later, in April 2015. In addition to seizing the computer and $25 worth of improvised equipment with which Ornig was able to intercept TETRA communications, officers also found a fake police badge and thus charged him with impersonating a police officer.
After analyzing his hard drive, police added a third charge of illegally recording his former employer. Recordings showed abusive language with his former boss, who called Ornig an “idiot” and called him a “stupid” person.
Despite the student's apparent good intentions and his cooperation with the authorities, police claimed that Ornig should have formally requested permission to conduct his research, which, they argued, interfered with the normal operation of some of the radio stations.
