That's in the US though. It's known that the US government does its best to protect the interests of corporations. There are other countries, in some of which reverse engineering something for the purpose of interoperability is explicitly allowed.

edit: looking at the list of cases, and knowing that the US legal system relies on precedents, it feels like using an online service's private API is allowed under this act.

Yes, as far as I can tell terms of service violations resulting from things like scraping/using unofficial APIs are not CFAA violations and certainly not criminal unless you are not supposed to have access to the data in the first place. The company may still sue in civil court but it has to be on other grounds. Which is why hiQ "lost" to LinkedIn and settled even though they won on the CFAA issue. And why Plaid is still in business.

The important thing is that it was suggested to use API keys which you are not authorized to use. Just because the keys are technically public it doesn't mean that you are authorized to use them.

If someone uploads their AWS token to Github it isn't legal to use it even if it was made public.

> If someone uploads their AWS token to Github it isn't legal to use it even if it was made public.

I'm pretty sure these kinds of services where you can incur significant charges by using the API have a stipulation in their ToS that any API calls performed with your key are considered to be made on your behalf. Kinda like banks do with online banking, "everything done online under your login is considered as if you've done it at a branch with paper forms". Regardless of laws it's still your own responsibility to protect your credentials.

Thank god for that act. Otherwise there might be fraud on the internet

Because all people comply with the law, especially the ones considering doing fraud on the internet

Why doesn't youtube-dl break this law?

Isn't it do similar operations to extract videos from websites?

They tried to shut down youtube-dl on copyright grounds because iirc the unit tests included URLs for some music videos and breaking their "DRM" constituted a DMCA violation or something like that. That was the only attempt I'm aware of.