is it a criminal offense to access an open website? if you had to use even a default password you could imagine it being improperly accessed,but if it's just open to the internet how is a criminal offence committed?
I would link some sources because you shouldn't trust just my vague memory, but it's incredibly difficult to find the right google search terms.
There has to be knowledge on the part of the offender that the access is unauthorised
So I guess it depends what the "offender" googled and what the link description said before they clicked it wrt open websites. And no doubt their explanation and demeanour when questioned etc.
https://www.cps.gov.uk/legal-guidance/cybercrime-prosecution...
Section 1
I imagine that depends. If your bank allows you access to another person's account by manipulating the URL, that presumably counts as a crime.
(Incidentally, this exact vulnerability has happened in the real world. https://news.ycombinator.com/item?id=2656837 , https://www.theregister.co.uk/2011/06/14/citigroup_website_h... )
"Manipulating the URL" -- "?id=1", "?id=2", "?id=3", in effect -- was enough to get Andrew Auernheimer (a.k.a. "weev") convicted and sentenced to ~3.5 years in prison [0].
Yes, his conviction was later vacated -- albeit due to a "technicality" ("improper venue"). Regardless, he still spent more than two years locked up for what really does seem like some completely exaggerated bullshit!
> "... [the Third Circuit judges] were skeptical of the original conviction, noting that no circumvention of passwords had occurred and that only publicly accessible information was obtained."
---
(Note: I've never met the guy, nor would I ever want to. Everything I've heard and read indicates that he's a pretty shitty human being -- and I suspect that didn't help him very much at trial. He almost certainly was deserving of some "bad karma" but that's not for the "justice system" to dish out.)
TL;DR: If you're in the U.S., you might want to think long and hard before taking that chance!
---
I suspect a much more interesting argument exactly is the issue with having this particular data - what laws are being broken by redistributing it (I don't have the answer). But that was not the point that you raised, hence my reply.
As I understand it, under GDPR data controllers have a responsibility to take reasonable measures to secure the data. I believe failure to do so is a criminal offense.