>Because it requires intentional effort to find information that is intended to be private. It requires you to "walk through the door."
There is no door though. The digital equivalent of your scenario is Tron.
An intentionally publicly accessible computer doesn't have well-defined boundaries. The line between authorized and unauthorized is very fuzzy, which is not a good feature in criminal law. Especially where defendants are characteristically individuals without the resources to defend their interpretation of the law in court.
>We do so to discourage people from poking around where they shouldn't, because such poking around is highly correlated with actual crime.
That seems like a self-fulfilling prophecy. If you criminalize poking around then only criminals will poke around. There are also much better reasons for prohibiting it in physical space than on the internet. Industrial equipment can be dangerous and cause massive property damage or personal injury if you mess with it. Invading someone's home impacts their physical security. These are rarely if ever the case with computers. Servers are (or should be) backed up, so even where there is highly valuable data, the extent of destruction someone can accidentally cause is limited to the cost of restoring backups, and reckless or intentional damage would continue to be illegal.
Harmless poking around also has the benefit of revealing vulnerabilities before they get revealed through malicious poking around. A kid who sneaks through your literal open window and starts nosing around in your house is not pointing out a critical security vulnerability; you know that your window is open. There is no benefit to the homeowner, the kid is just a pest. But computers have higher security requirements: The equivalent of an open window is a major failing in need of immediate attention, because if a kid can get in then so can foreign criminal syndicates, and if they get in they'll be doing more than poking around.
>Allowing people to poke around freely makes enforcement hard. Everyone who actually did something wrong is going to claim "oh I was just poking around."
Won't the fact that they actually did something wrong give lie to that claim? The ones who are actually doing something wrong will be found making charges to purloined credit card numbers or modifying shipping information in databases or the like. I suppose you may catch someone in the act before they have an opportunity to do any such thing, but if you have someone who is really trying to do wrong, isn't it better to extend the investigation so as to be able to charge them with the serious crime they actually intended than to roll them up right away on a minor offense?
>Why can't security researchers get consent from their subjects to do experiments on them, like every other kind of researcher?
Discovering vulnerabilities in production servers is not really research, it's more like being a plumber or a firefighter. There may be professionals who are paid to do it, but if you see water leaking or smell smoke, taking a moment to do some cursory looking around to see if there is a serious underlying problem should be just part of being a good citizen.
As for asking permission, the trouble is that the transaction cost consumes the transaction. If someone goes to a website and notices that the URL has a 'userid=1157' appended to it, the natural thing to do is to try putting in 'userid=1158' and see what happens, because the two most overwhelmingly likely things are either for it to produce an access denied error and be harmless, or to log you in as a different user and be harmless as long as you don't further abuse that fact. And 99 times out of 100 it will be the first one. Which is why requiring permission breaks the propensity for good people to help out: If the expectation is for people to ask permission before doing something like that, the website operator is going to have anyone who notices that asking about it, and if it isn't broken then it gets annoying, which annoyance is conveyed to the people asking about it so that in the future they stop asking and stop helping. Which is I think what we see: Security people mostly don't poke websites because the law prohibits it, so security flaws don't get identified until the bad guys identify them.
I would also distinguish this from doing something like SQL injection or exploiting a buffer overflow, which can reasonably be expected to cause a denial of service or data corruption. In those cases there could be a charge for something like reckless disregard for damaging a computer system as opposed to purely for unauthorized access.