I agree with the notion of culture jamming to highlight neglected vulnerabilities in computer security. However, I draw the line at stealing/publishing personal information, encouraging the defacement of personal sites, etc.

Let me give an example: One of the lulzsec "hacks" involved stealing passwords from an adult content website. They proceeded to encourage people to find other websites those users might have accounts on that utilize the same password, and deface them. One young women's Facebook account was broken into. The "hacker" posted erotic pictures the woman had taken of herself (posted on the adult site), to her Facebook wall. This young women, who was clearly not involved in defining the security policy for the adult site, and who clearly was not involved in the security industry, was humiliated. I found out about it because people from lulzsec were passing around the link to her Facebook account. That's not necessary. It's not justifiable in any way, shape or form.

I would much prefer a "TeachSec" who do culture jamming pranks that teach people about the security risks online -- in a positive fashion. For example, I wrote an article for the Summer 2010 issue of 2600 magazine that outlines how to create an "Educational Wireless Honeypot". Basically, it involves setting up a rogue Wireless AP and managing DHCP/DNS requests to redirect the user. Instead of sending the user to goatse or whatever, the user is directed to a page that provides a warning and information about the risks of unencrypted, unverifiable, wireless. That approach seems much more productive.