If the response code is 200, it's OK. The response code (not to mention the transmission of the file) is literally permission from the system to have the resource.
If you don't want someone to come in your door, don't put up a sign that says "come in."
If you don't want someone to see a resource at a URL, don't send them a 200 response code or serve the resource. That's the convention for the web.
This conversation has devolved into arguing against the analogy. This is the internet: everything on it is public unless care is taken to make it not so.
You may choose to argue whether or not that should be, but that's the way it is.
The Internet should be treated the same. Anything put on the Internet should be presumed to be public unless there is some indication to the contrary.
In this case, most of the information he accessed was clearly intended to be public, so there was no reasonable way for him to know that there was some private information improperly co-mingled with the public information, so he can't be faulted for not realizing that he shouldn't have accessed some of the information.
Elsewhere in this thread, people have pointed out that Google has crawled (and cached) at least some of the pages that were supposedly criminally accessed.
Edit: I mean not the act of listening, but the act of storing unlicensed material