> instead the doctor ships you his entire filing cabinet with your folder taped to the top

and as soon as you get this data and you read all that information sent to you by mistake instead of seeing it's not yours and stopping, you have committed a crime. what exactly is it that you don't understand here? what the op did is literally against the law.

>pushed

you should look up how http works. the request to get the data comes from the client browser. it's called a GET. the op requested to GET someone else's records from the server, after knowing the GET request he sent to the server would get him this information.

so again I ask - what is it that you don't GET here? The OP very literally committed a crime. a crime being very easy to commit, does not make it legal.

> and as soon as you get this data and you read all that information sent to you by mistake instead of seeing it's not yours and stopping, you have committed a crime.

There's no such crime. If you disagree, by all means cite a statute.

> you should look up how http works.

I'm intimately familiar with http. Upon issuing a request for your records (the request, GET or otherwise), you receive a response, pushed to you, with records you did not request.

I think you may want to re-read my comment, this time more carefully and thoughtfully.

"push" means the data is pushed. as in without a request from you. it's mind boggling how you are not getting this. exchange is an example of this - you get email pushed to a listener on your mail client, without requesting that data. if you use pop3 however, you request the data and receive a response. you are arguing a request - a GET - the literal opposite of a push, is a push. this is something anyone who has used email would know, so you are being purposely dense, and this conversation is done - I will not read your reply.

as far as the crime, it's called unauthorized access to a computer system, and many people are in jail for it. whether that system is password protected or not makes absolutely zero legal difference.

We don't have to continue the discussion but I'll wrap this up regardless for the peanut gallery.

As I've mentioned, my metaphor is request, response. This additional data is included, unsolicited, piggybacking on the response. I think this is clear.

Regarding the crime, no, this is completely incorrect. It sounds like you're referencing 18 USC § 1030. This law cannot apply whatsoever to this situation because there is no unauthorized access. The data was pushed, unsolicited, as part of an authorized access. It's being sent to all users when they use the system in a normal authorized fashion.

Viewing the data takes place on the user's own device, because the state itself put the information there. We are all authorized to access our own devices as much as we please.

The suggestion that the CFAA might apply here is nothing short of absurd.

But where are you getting your whole "piggybacking" idea from? The original story was that the user "verified" that he could get anyone's data by changing an integer in the URL. Typing a new URL into his browser makes it, in Web terms, a new request, not anything "piggybacking" on an old one.

So the data was pushed, very much solicited, as part of a new access. That the user's browser held an authorization (cookie?) for a previous access to the user's own data doesn't quite, AFAICS, mean that this new access to other data was also actually authorized.