If your personal site gets breached, it's akin to someone having walked into an unlocked house. You have a right to keep your house unlocked because the only one that's going to be hurt by your negligence is you and possibly your family.
A business owner that stores massive amounts of private information is not allowed to keep his doors unlocked, because it amounts to gross negligence. It wouldn't be right for someone to walk right in and steal everything, but the business should be held accountable, because they don't have the right not to secure their customers private information.
He sent an HTTP GET request, and the server responded. This isn't walking into an unlocked house. It's more like walking into an unlocked storefront during business hours, asking permission to view a certain item behind the counter, and being granted said permission by the clerk, who hands it to you.
> Just because he didn't use a crowbar doesn't make it any less intentionally criminal.
If those documents were not supposed to be viewable, the server should reject the request. Making a request is not a crime. You are literally asking, "Can I please see the document stored at $LOCATION?" If the answer is no, the server has a means to do that: send an HTTP 403 response.
The "unlocked house" analogy might hold if he tried to ssh into their server as the root user, but in this case, AT&T should have been held responsible for gross negligence for allowing people browsing[0] their open "storefront" (their website) access to personal customer information.
To use another analogy, if you submitted a FOIA request for classified documents, can the government satisfy your request (by sending you the documents) and then charge you with a felony for requesting those documents? I wager that most people would say that the fault lies with the government for failing to deny your request.
Publishing the documents later on is a separate matter, but the crux of weev's case focused on the fact that he obtained them, not the fact that he published them, which is maddening, because that logic would break the entire model of the web by breaking HTTP.
[0] Not to get too hung up on terminology, but notice that we use the term "browsing" the web to refer to HTTP requests, but we don't talk about "browsing" an ssh login.
It certainly should, but it also should be obvious that this was not information that he was authorized to have, and he was prosecuted for intentionally scraping it after noticing the misconfiguration - not for making an HTTP GET request.
The idea that a GET request is like asking a clerk for an item under a counter is appealing, but doesn't really work because granting access is not the same as granting authorization. Authorization requires intent, and an HTTP server is incapable of intent (at this point in history, anyway). The fact that the server can be misconfigured and is fundamentally incapable of realizing it means it makes a lot more sense to think of it as the counter rather than the clerk, and items with 403 responses as items that are under a glass counter. For this same reason, the FOIA request example doesn't work either. A human (or many of them) processes that request.
Additionally, the items he took were not items the store sells, they were clearly items the store should not have out in a public place (so yes, the "store" is absolutely not blameless).
In light of these observations, I think a better analogy is this:
A man walks into a store. He spots a binder on the back counter, just close enough he can reach it without actually stepping behind the front counter. It contains a printout of the store's mailing/cold-calling list that they use for [whatever silly purpose]. The clerk is busy elsewhere, so he starts flipping through it page by page, taking a photo of each one with his smart phone.
Now, I'm still not sure what I think of the legality or morality of the situation, especially when you try to factor in intent. I'm also not a legal professional of any kind, so I know even less about what a court would think about all that. But I do think that these details are relevant, and leaving them out of an analogy creates a false impression that there's nothing even debatable about the situation.
Edited to add: FWIW I do agree that AT&T is very much at fault, mainly for the reasons phaus gave in the comment sibling to yours. I just don't think it is obviously the case that their guilt excuses the person that takes advantage of that negligence.
Your analogy, for the record is wrong. Completely wrong in fact. But enough with the analogies. We have 20 years of mainstream HTTP usage. We know how it works. Authorization over HTTP is a solved problem and can be done in multitudes of ways, trivially. If he's breaking the law than so is Google millions times over because there are a shit ton of indexed pages that technically Google wasn't authorized to crawl. If your web server is configured to fulfill all anonymous requests, then you are implicitly granting the authorization to access this data. This is the way HTTP was designed. That's the only way this all makes sense, otherwise youtube can change their TOS to make every person who views a video a criminal.
Googlebot is incapable of intent. It is a computer program that simply crawls accessible pages. It cannot distinguish between a website for which access is obviously not intended (i.e., Weev's case of accessing *other people's private information) and a website for which access is intended (i.e., a public Facebook or LinkedIn page).
Google is trying to index as much of the web as possible so that it can provide a better service, attract more customers, and make more money from its advertisements. Therefore, the use of a program that scans the web and accesses documents which Google does not have permission to view makes Google responsible for routinely and intentionaly breaking the law.
Also, that your tool cannot filter content particularly well does not mean you get a free pass. It means you were negligent.
...or at least that is one way to interpret the law. The law is bad. You can't just say it's illegal when its illegal. It should be as cut-and-dry as possible (e.g. killing someone is always illegal, even when it is an accident a la accidental manslaughter).
It's more like you're handing out personal documents on the street to everyone with a mustache and some guy comes up with a fake one and you get tricked.