I actually like the paper analogy a lot, let's extend it: Say the journalist was instead freely handed a redacted government document on sheets of paper. The reporter notes that it was redacted poorly and the redacting can be peeled off or a bright light can be shined on it to reveal the text underneath. By doing this, is the reporter committing a crime? I have no idea. My intuition says probably not, but I think interestingly it's not a "definitely not" because 1) it's apparent to the reporter that the redacted information is intended to be private and 2) the reporter took some steps to uncover that information.

It's still not a perfect metaphor. It's not immediately clear that 1) is true here (the reporter probably was not trolling for private information) and it's highly questionable if 2) is true as it seems that this info was being sent along in HTTP responses. What is obvious to me is that that this guy had no malicious intent, took steps to do responsible disclosure (they didn't publish the article until the issue was fixed) and is being targeted by the political establishment as retribution for embarrassing them. Shameful stuff.

If it was just in the html the website served to you, and it just basically has it written in a way that tells the browser to not display that part of the html. Wouldn't that be closer to handing a journalist a government document with some text, then a line saying: "don't read the stuff below this line", and then a bunch of sensitive stuff below that in plain text?

All analogies are flawed. My main point was that, in terms of the Governor's own analogy, and also literally, the reporter didn't "take" anything.

All analogies aside, intent matters, and the reporters intent was to report a vulnerability and then to report the Government's actions to the public once the vulnerability was fixed. Neither of which are illegal.

No, because there is a difference between “being displayed by default” and “explicitly forbidden from being viewed”. It’s closer to requesting information, and in response being handed a bunch of material, some of which is in a stack of papers and some of which is enclosed in an unsealed, unmarked envelope. It isn’t displayed by default, but it’s there, and with the most minimal of effort it’s viewable, there is nothing explaining it shouldn’t be viewed, and it’s not absurd to assume that if it was included in the bundle of information you received in response to a question, it’s fine to view.

The onus is on the person providing the information to not include it in what they provide, not the viewer to not look at information provided.

With your redacting example, we don't even need to decide if looking at the paper with a light is illegal. The reporters discovered the poor redaction, and immediately informed the State that it was poorly implemented. They did not disclose this was a problem until the problem was fixed, and new papers were handed out without this flaw. How can you argue someone did something illegal in this case!

There have been many instances where PDFs have been "redacted" by painting black rectangles over the text, but keeping the text intact. I can't think of anyone who has been prosecuted for unredacting those documents - the people who did their jobs poorly are considered liable.

A barebones PDF reader implementation would/could not render that 'layer' anyway, so I can't imagine you'd actually lose such a case. (As distinct from not having the will/funds to fight it long enough...)

At least the invisible ink is an attempt at hiding the information. A comically bad attempt but still an attempt.

A better analogy would be that the state sent the journalist a document with everything readable in regular light, and a separate sheet that tells him which words he must redact. There was no attempt to conceal information, and worse, the redaction list would have been promptly ignored by anyone using a screen reader or other accessibility devices.