Do you jiggle door handles out of habit to see if they're unlocked? It's antisocial behavior. If you were supposed to have access to that document, it would be accessible from a link or search box on the main site.
So while going to the filing cabinet to get the file he'd been directed to, he leafed through other files too. Why not? They're all public information, since they're sitting here in the unlocked filing cabinet with all of the other public information files.
Turns out some of them were mislabeled, and were private information in the public information filing cabinet.
Not so weird, not so antisocial, not his fault, shouldn't be his problem.
Sure, it'd actually be like checking out every book in the library, but this is the age of the internet and it's an insanely useful skill to learn how to grep large amounts of text.
IMO this looks like a company that did a poor job trying to cover their mistake by blaming "those hacker folks". I don't think it's inappropriate to confirm the kid was acting without malicious intent, but the subcontractor who setup the security for this site needs to be investigated thoroughly.
You don't seem to realize how bad of an idea this is. You're talking about making criminals of people. You know, I think I remember once reading about how chrome would try the address you type while you typed it (i.e. before pressing enter, it'd make a request for every character you typed). Users of chrome could become criminals because their software would do this.
This conversation has devolved into arguing against the analogy. This is the internet: everything on it is public unless care is taken to make it not so.
You may choose to argue whether or not that should be, but that's the way it is.
Elsewhere in this thread, people have pointed out that Google has crawled (and cached) at least some of the pages that were supposedly criminally accessed.
Edit: I mean not the act of listening, but the act of storing unlicensed material
If the response code is 200, it's OK. The response code (not to mention the transmission of the file) is literally permission from the system to have the resource.
If you don't want someone to come in your door, don't put up a sign that says "come in."
If you don't want someone to see a resource at a URL, don't send them a 200 response code or serve the resource. That's the convention for the web.
The Internet should be treated the same. Anything put on the Internet should be presumed to be public unless there is some indication to the contrary.
In this case, most of the information he accessed was clearly intended to be public, so there was no reasonable way for him to know that there was some private information improperly co-mingled with the public information, so he can't be faulted for not realizing that he shouldn't have accessed some of the information.
Best analogy I can think up is an automated free vending machine, with a row covered up by a piece of cardboard. If you don't want someone drinking the cokes on the hidden bottom row, why did you put them in the machine in the first place?
But no, it shouldn’t be illegal. Yet what he said still completely applies to stuff like fiddling with ids on a site where you suspect it might lead to content you shouldn’t be able to access
Unless you’re whitehatting and plan to inform them of the security issue (probably anonymously because the world is fucked up and whitehatting can lead to jail time -_-)
Just because what you're doing is legal, doesn't mean you're not an asshole
The kid got documents on a public facing server. He did nothing wrong.
The blame truly lies on the government for allowing such porous security. They should be glad a seemingly benign teenager discovered their flaw and not some more nefarious actor.
1: https://www.eff.org/deeplinks/2010/07/court-violating-terms-...
A terms of service can not define law, but it can make explicit what data a provider is authorising a user to access.
"The Access to Information website allows you to submit, pay and receive FOIPOP requests online. The Nova Scotia Government also posts responses to formal FOIPOP requests online on the Disclosure log. This is a free public repository of FOIPOP responses that have been approved for publication and have met a specific set of criteria (PDF file 800 KB)."
I also have a huge problem with the stance that violating the "Terms of Use" policy of a website can result in criminal charges when accessing publicly available information.
That's what a url with an id in it is
a link
> In computing, a hyperlink, or simply a link, is a reference to data that the reader can directly follow either by clicking, tapping, or hovering. A hyperlink points to a whole document or to a specific element within a document. Hypertext is text with hyperlinks. The text that is linked from is called anchor text. A software system that is used for viewing and creating hypertext is a hypertext system, and to create a hyperlink is to hyperlink (or simply to link). A user following hyperlinks is said to navigate or browse the hypertext.
The URL in the abstract is not a "link." A link is an element in hypertext.
Whether we like it or not, language evolves. If “literally” can, then literally any other word can too.
Should you not have the freedom to type what you want into the address bar of a browser?
This is like going to a library, asking the librarian if you can check out a book, being told yes, and then later being arrested because they meant to say "no".
I think the real question here is: did the website provide enough information for the user to have been assumed to understand that what they were accessing wasn’t meant to be public (e.g. did the door look like a door to a private property)? And did the user cease to access the data once they understood it (e.g. did they close the door and leave)?
It implies the exact opposite. The owner may have intended it to be private, but making it publicly available, without security checks on a publicly accessible server, implies the property owner intended for people to access that property.
https://addons.mozilla.org/en-US/firefox/addon/nextprev-page...
https://chrome.google.com/webstore/detail/urlnext/emepkgfiam...
That's in a nutshell what happened
The employees who work there have access to all information. Why wouldn't they? They work at the information bureau.
They also answer all questions. Why wouldn't they? They work at the information bureau.
You walk up and ask questions. You get answers. Three days later, you're arrested for knowing state secrets.
Do you see a possible problem with this arrangement?