He did have authorization to access it. He didn't have authorization to abuse it in the way that he did. It's all kinds of icky but what do you think was so obviously criminal about it that you expect him to be in jail?
http://www.pcworld.com/article/154392/snoopy_verizon_employe...
Didn't get charged, let alone arrested, either.
- reading private communications of people he knew in real life
- retrieving IM conversations and publicizing them without consent or knowledge of the user
- re-inserting himself in contact lists after being removed to stop the harassment
- seeking real life contact with people whose private information he had retrieved
Let's hope there wasn't more.
Each and every one of those would be a firing offense, the fact that this is beyond just snooping and led to irl contact between this guy and the people (kids?) he was stalking means the situation is more than out of control.
Mistakes happen, but such a series is not a mistake any more.
A position of such trust requires a more than ethical behavior and good oversight. Google failed in the second.
A good sysadmin has 'sysadmin blindness', even when you're looking at user data to do your job, you are not going to read the emails that sit in those inboxes unless you are specifically directed to do so by the owner of the data.
For the rest those files might as well contain random bits.
That is why I got angry with PG in this thread:
I am not a lawyer, but I can imagine at least asking for someone to look within these categories. I would personally feel very violated if I had some stranger even commenting about an email that was not directed towards them ... and even more violated if that stranger manipulated the system to get beyond whatever walls I threw up.
(Edit: Note that I work at Google as an SRE. This limits how much I can say in this discussion.)
This is the huge problem we are still facing with computer crime; because the law is still quite vague and unresolved. Juries have a tendency to not really "get" what has happened and so figure it's not all that bad etc.
It seems rotten but the best chance you would have with this is in getting the Jury excited about the stalking aspect and the contact with children.
Technically he has broken the law (at least, I think he has). Proving it though, along with mens rea (intent) is an absolute minefield and it would be torn apart by a decent lawyer. This is why most computer criminals are currently prosecuted for other crimes (in this case, probably the stalking offences).
If I break into google and poop on the floor of their server room, I can be arrested, but if one of their sysadmins gets in with their key and then poops on the floor of the server room, they can only be fired.
http://www.justice.gov/criminal/cybercrime/ECPA2701_2712.htm
Even if it's not, I maintain that if you've done something that seems like it might be illegal, they can usually find something to charge you with.