I keep seeing posts referencing that his actions were "technically trivial." How does anyone propose we write or enforce legislation based on that criteria?
If I told a client that I had 'secured' their website, but access was available by incrementing an integer, they could sue me and they would win.