You just gave them money. They didn't coerce you. It would be different if they flashed a weapon.

It's a fictitious example. I didn't say there was no weapon, nor said it was definitely theft. The point is that submitting a GET request in a public setting does not mean no crime.

Coercion can be the difference between asking for money and theft. In the case of this intel data, it was clearly coerced from a server - it's not like it was linked on Google, they had to specially craft URLs to coerce the data out.

For there to be theft a property owner has to lose their property and or use of said property.

There is zero theft in this discussion.

One could argue there was infringement, and that argument is very difficult to make without breaking the Internet for everyone just because someone with deep pockets failed.

Coercion involves, at the core, an act of agency performed to the intent of someone else, who is not the agent, actor.

Bad practice does not support coercion at all.

I wonder whether that word even applies to entities lacking agency.

Servers are automatons. They do not make value judgements and or creative acts of agency of any kind.

We need these things as a basis for coersion.

There are lots of things not indexed by Google and it is dangerous to imply people are somehow wrong when data is accessed sans a Google index.

Security by obscurity does not make sense. This mess is part of why.

Again, I don't believe it's accurate or honest to call this coercion. These files were obtained from a content delivery network by visiting a url in a browser. Nothing deceptive, cunning, crafty, or coercive about it. Let me ask you, what files am I allowed to access on a public network? Must I ask owners permission before visiting their websites? Must I be able to find it with a search engine? What constitutes a file which anyone is allowed to view?

Were the files listed when going to http://server.com? No, the user had to:

1. Find the server via nmap

2. Guess at some URLs until the server finally responded with some hidden data.

While neither of those would require being an expert in the field, this is well beyond the realm of browsing public websites.

This is incorrect. Actually, yes, the files were in fact browseable and Akamai servers typically front with DNS names that presumably resolve to their any-cast addresses where they use SNI to select content bucket, so there would have been a "friendly" name involved. Going to https://server.com/folder displayed a list of folders and files all hyper-linked and connected as is common on the internet. The fact that the server was initially discovered by way of a crawler, a scan, is irrelevant (this is actually how search engines discover content, btw). The fact that a browser could browse these files suggests that it is not "well beyond the realm of browsing public websites".

Exploration of public areas isn't illegal. There's no law mandating that viewing a website though the browser is legal, and any other means not. Techies legitimately access websites in all kinds of programmatic ways. Intel made their data publicly available. That it wasn't accidental doesn't change that.

Opening unlocked doors, entering and removing property is generally considered to be theft.

The key here is that these services were not advertising their presence.

Theft requires property owners to be denied their property or the use of it.

That did not happen here. Theft is not part of the discussion.

Infringement could be, and is at least the right language for the discussion.

Where are the locks?

There are often ways to beaches and other spaces unadvertised, but otherwise OK to use.

Sure looks to me like a potential landmine for people. Bad practice with big pockets should still just be bad practice with the same consequences for all who don't bother with better practices.

There was no lock on this at all.