You have a lot of faith in how technically versed the law and courts are on these topics - because they sure haven't kept up with the times. And even if they were willing to split hairs over these technical details:

No civilian will agree with you that just because technically you could slip through several doors that happened to be not locked and got helpful advice from a neighbor, it doesn't mean that whatever you found behind those doors was "public" just because you didn't have to pick locks. Or that the photos you took of private company documents by social engineering your way inside must clearly be unsecured and publicly distributable because "they were given to me when I asked for them".

This isn't slipping through various open doors. There were no doors. This is literally a public server on the public internet serving files publicly. Intel is grossly negligent in securing their assets if they're hosting what they consider to be confidential trade secrets on public CDN servers.

The analog would be if I posted a flyer on a telephone pole with what I considered confidential information and someone else took a picture of it. There's no way you could argue that I had a reasonable expectation that only people for whom the flyer was intended would be able to view the flyer.

If someone deliberately bypassed computer security measures to acquire this information I'd agree. But you don't get a free pass to be negligent just because you're a big company. I suspect the EFF would support my viewpoint as they supported Weeve's appeal of a much more contentions and ethically gray scenario (the acquisition of personal information from a server that was negligently "secured" and required someone to imitate the calls an iPad would make).

> This is literally a public server on the public internet serving files publicly.

The flyer analogy does not work because the services were not broadcasting or otherwise advertising their presence.

Following the house analogy, the thief tested all the front doors on the street and opened those which were not locked.

Then search engines must not be legal. They crawl the public internet and index what they find.

What you’re effectively saying is that the flyer is unknowable unless a Street-view car drove past and snapped a picture of it and its owner engaged in SEO to make sure it landed near the top of search results.

There is no “house” in this analogy (which you might call a corporate/private network secured or otherwise). No private network was accessed. This stuff was on the street, in the free pamphlet section of the newspaper stand.

That’s a very weak argument. If I’m walking down the street at night and somebody comes up to me and says “GET /money”, I may respond with an HTTP 200, but that doesn’t mean the person didn’t just steal from me.

You just gave them money. They didn't coerce you. It would be different if they flashed a weapon.

It's a fictitious example. I didn't say there was no weapon, nor said it was definitely theft. The point is that submitting a GET request in a public setting does not mean no crime.

Coercion can be the difference between asking for money and theft. In the case of this intel data, it was clearly coerced from a server - it's not like it was linked on Google, they had to specially craft URLs to coerce the data out.

For there to be theft a property owner has to lose their property and or use of said property.

There is zero theft in this discussion.

One could argue there was infringement, and that argument is very difficult to make without breaking the Internet for everyone just because someone with deep pockets failed.

Coercion involves, at the core, an act of agency performed to the intent of someone else, who is not the agent, actor.

Bad practice does not support coercion at all.

I wonder whether that word even applies to entities lacking agency.

Servers are automatons. They do not make value judgements and or creative acts of agency of any kind.

We need these things as a basis for coersion.

There are lots of things not indexed by Google and it is dangerous to imply people are somehow wrong when data is accessed sans a Google index.

Security by obscurity does not make sense. This mess is part of why.

Again, I don't believe it's accurate or honest to call this coercion. These files were obtained from a content delivery network by visiting a url in a browser. Nothing deceptive, cunning, crafty, or coercive about it. Let me ask you, what files am I allowed to access on a public network? Must I ask owners permission before visiting their websites? Must I be able to find it with a search engine? What constitutes a file which anyone is allowed to view?

Were the files listed when going to http://server.com? No, the user had to:

1. Find the server via nmap

2. Guess at some URLs until the server finally responded with some hidden data.

While neither of those would require being an expert in the field, this is well beyond the realm of browsing public websites.

This is incorrect. Actually, yes, the files were in fact browseable and Akamai servers typically front with DNS names that presumably resolve to their any-cast addresses where they use SNI to select content bucket, so there would have been a "friendly" name involved. Going to https://server.com/folder displayed a list of folders and files all hyper-linked and connected as is common on the internet. The fact that the server was initially discovered by way of a crawler, a scan, is irrelevant (this is actually how search engines discover content, btw). The fact that a browser could browse these files suggests that it is not "well beyond the realm of browsing public websites".

Exploration of public areas isn't illegal. There's no law mandating that viewing a website though the browser is legal, and any other means not. Techies legitimately access websites in all kinds of programmatic ways. Intel made their data publicly available. That it wasn't accidental doesn't change that.

Opening unlocked doors, entering and removing property is generally considered to be theft.

The key here is that these services were not advertising their presence.

Theft requires property owners to be denied their property or the use of it.

That did not happen here. Theft is not part of the discussion.

Infringement could be, and is at least the right language for the discussion.

Where are the locks?

There are often ways to beaches and other spaces unadvertised, but otherwise OK to use.

Sure looks to me like a potential landmine for people. Bad practice with big pockets should still just be bad practice with the same consequences for all who don't bother with better practices.

There was no lock on this at all.

If someone leaves their door unlocked and open it doesn't mean I have a right to walk in and take what I want.

This is more like leaving it on the street, mixed in with a lot of other free stuff.

Physical analogies break down.

Truth is, this info was out there for anyone to copy, and who ever did that is definitely guilty of something and or liable.

It will be tough to make passers by into criminals here. They aren't.

Keeping secrets is hard. Should be.

I wrote this poorly. Meant whomever left this data in the clear is guilty of something and or liable.

It would be like keeping a dropped wallet - the person who keeps it is guilty, not the person who accidentally dropped it.

No it wouldn't. It would be like taking a picture of a dropped wallet on the street.

Regardless, under what moral framework are we operating such that obvious guilt is prescribed to anyone who might pick up a wallet in the street, anyway? Of what crime are they guilty?

Verizon and US courts would disagree with you.

Links? I'm curious about existing case law.

Here's one example: https://www.wired.com/2013/03/att-hacker-gets-3-years/

>The two essentially wrote a program to send GET requests to [publicly available pages on] the web site.

Ruling was appealed and deemed incorrect: https://www.wired.com/2014/04/att-hacker-conviction-vacated/

Not quite, it was vacated on the grounds of improper venue. It wasn't reversed or similar; to be vacated is to be voided, as though the case never occurred.

I mean yes. I wish it was actually reversed on grounds that the ruling didn't stand. But that was the intention of the appeal. Dismissing it on improper venue is simply tactical. This is the legal system's way of saying, "there was enough contention in this case that we don't feel comfortable with the whole thing in the first place so we'll throw it out on a technicality and avoid inventing any case law here".

I'm not a lawyer, but I'm not 100% sure if thats's the best interpretation. It being thrown out on a technicality doesn't necessarily imply anything about their feelings regarding the facts of the case.

Basically, I would not be surprised that if the exact same case happened today, the defendants would still get jail time.

Not sure about US but in France it's considered a quite serious crime