When the access is freely given out without any subterfuge, it's not my job to self-enforce my best guess at what my access level should have been.
In this case, it would be like going through the UI and trying to access the record and getting denied because of a client side access block, so you make a direct call to the backend instead to retrieve the record. You’re making a perfectly legitimate HTTP request but for something you know you shouldn’t be able to access: illegal.
Personally, I would not bet my freedom on that assumption.
CFAA covers unauthorized access to protected computers, not piles of records on park benches.
And "protected computer" is basically all computers. Imagine if the records were on a kindle; that shouldn't change the legality and if the CFAA does so that's a bad thing.
Is it really though? What harm may come from legislation preventing you from rifling through somebody’s phone that they left on a park bench?
I’m not saying CFAA isn’t problematic, but I’m very unconvinced that this is the problematic part.
A public web server doesn't have such direct privacy issues.
When it comes to records on a bench vs. a non-personal kindle on a bench, I think they should have equal and low protection. Abusing the data should face penalties, but not poking around.
I don’t see any obvious reason as to why this should be allowed, but it’s trivial to come up with a whole plethora of reasons for why you shouldn’t be allowed to poke around such devices.