That's not how it works. If a badly configured NSA server displays confidential data on your screen, you're still a criminal if you make use of that to access data.

> it shouldn't matter

According to? That's an ethical stance one can take, but it isn't how our laws work.

>According to? That's an ethical stance one can take, but it isn't how our laws work.

What law? Please be specific here as I'm not clear what you're getting at.

If you're referring the Computer Fraud and Abuse Act (CFAA)[0], it states:

   The law prohibits accessing a computer without authorization, or 
   in excess of authorization.

WRT NSA servers, accessing classified information (assuming you don't have clearance and/or a need for that information) would violate the CFAA and possibly the Espionage Act[1].

However, in this particular case, an end user is accessing data (with appropriate credentials that have access to no more and no less than the data they are authorized to access) for which they have appropriate authorization. As such, it can't be a violation of the CFAA. So, where's the "crime" here?

I'm not sure how you're getting from point A to point B here. If you could help me out, I'd appreciate it.

[0] https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act

[1] https://en.wikipedia.org/wiki/Espionage_Act_of_1917

> If a badly configured NSA server displays confidential data on your screen, you're still a criminal if you make use of that to access data.

If a badly configured NSA server gives you data, intentionally accessing it (and/or then misusing the data) would be the crime. I don't think it matters whether you view that data in a browser, a terminal or some third-party client.

Here, the third-party client is accessing the exact same data the official client is. It's not bypassing any access control, in fact it needs your credentials to be able to access the data you're authorized to view.

> According to? That's an ethical stance one can take, but it isn't how our laws work.

I'm not even sure if a law has been broken here? Breach of ToS != crime. As far as I know there is no unauthorized access taking place - the unofficial client is using your credentials to legitimately access the same API as the official one does; it's not giving you any extra data that the official client doesn't.

Of course it wouldn't be a breach if the data just popped up on your screen without you actively trying to access it. But if you, knowingly, access material you shouldn't have access to, it could be a breach of ToS.

> Breach of ToS != crime.

Breaching a contract is not generally a crime either. But it might lead to a civil case.