He literally asked the web server "can I have these files" and it responded with "yes, you are authorized, here you go".
If he wasn't authorized, the server should have responded with a 403 Forbidden!
Web servers are built around authentication and access rights! It is not the teen's fault that the government doesn't know how to configure them properly.