I'd start with the following, and refine if necessary:
"Gaining unauthorized access to a protected computer resource by technical means."
- Port scanning --> Not hacking because there isn't any access to resources gained
- Using default passwords that weren't changed --> Not hacking because the resource wasn't protected
- Sending spam --> Not hacking because there isn't any access to resources gained
- Beating the admin with a wrench until he tells you the key --> Not hacking because it's not by technical means.
- Accessing teacher SSN's published on the state website in the HTML --> Not hacking because the resource wasn't protected, and on the contrary was actively published*
- Distributed denial of service attack --> Not hacking because there isn't any access to resources gained
Those first two actually happened in 2001 here in Switzerland when the WEF visitors list was on a database server with default password, they had to let a guy (David S.) go free
* The governor and his idiot troupe eventually stopped their grandstanding and didn't file charges against Josh Renaud of the St. Louis Post-Dispatch reporter, luckily