It's more like if you walk up and find the document on my doorstep, turn around to see the 'no trespassing' sign, then leave with the document anyway.

Again - I don't really agree with the ruling here - just trying to clarify.

Except I found the documents on Google. It's the equivalent to advertising a yard sale but not realising what you were selling / showing the public.

That sounds about right, actually. Half the yard is clearly free, but they failed to mention that you can't even view the other half.

But wasn't the quote indicating that it was made clear somehow? Looking at the anses.fr site isn't particularly helpful, if that's even the site in question.

I dunno, having a yard sale is 'opt-in', since you're putting up the signs etc, showing up on Google is more 'opt-out'.

Isn't it more opt-in because you need to put a link somewhere on the public www before Google can find it?

Yes but links can leak in the most accidental fashions. Google seems to find a lot of stuff that makes me wonder how Googlebot ever found such links. Part of the explanation might be referer logs, and such.

Anyway, the point is, it's smarter to be explicit and also opt-out using robots.txt or something similar.

If your side gate was open when the googlecar drove by and put it on streetview, does that mean that anyone else is entitled to wander in and take things should the gate be open as they pass by?

Except that advertising takes positive effort on your part, whereas it takes positive effort to avoid being listed on Google.

I don't know, but I think "putting up a web server" qualifies for "positive effort" ;-) And while it does take extra work to ensure an Intranet isn't available on the public web, or that it's correctly configured to require a login to view documents ... there has to be a line somewhere.

I mean, I've stumbled on FTP sites that allow anonymous users. By providing no password and still seeing content, would I have "hacked" them? It's a configuration issue, and password prompts are just that. Of course, where do you then draw the line? If you call it a security flaw that the documents were public, then accessing them could be an exploit. But... a very flimsy one, since we rarely execute injection attacks to visit websites, but we often click links on Google. The bar is clearly very low. ;-)

This might, of course, change if the access was not indicated on Google but instead on a site like shodanhq.com ...

More of a 'keep off the grass' sign. It's not at all obvious that the authentication is supposed to apply to other areas.