French journalist "hacks" govt by inputting correct URL, later fined $4,000+

The main count on which Bluetouff was found guilty is that of "maintien frauduleux dans un système de traitement automatisé de données (STAD)", namely, remaining "in" a computing system (STAD) without being allowed. The key point is that Bluetouff made an important admission, apparently during his 30 hours of "garde à vue", meaning, being under arrest at the police station, where he seemingly neglected to apply his right to remain silent: he recognized that, when going up the folder hierarchy, he landed on a username-password login page. From this, according to the court, he should have inferred that the documents were private and that he had nothing to do there. Instead, he spent several hours siphoning the documents afterwards, which established his intent to remain in the system despite having found out that he wasn't supposed to.

One can then discuss whether this law is fair or not, whether things would have been different had Bluetouff not made this key admission, whether it is reasonable to consider that the login page was sufficient to indicate that the documents weren't intended to be public, and whether the 3000 EUR fine is balanced or not.

Meanwhile, Bluetouff has appealed the ruling to the Cour de cassation, France's last-resort court for civil and criminal cases, whose role is to break rulings where the law was not correctly applied (without discussing the findings, only the application of the law and the adequate forms). I do not think we know yet how Bluetouff will phrase his appeal, but Eolas estimates that there would be a possible way to attack the ruling based on the court's finding that Bluetouff's retrieving the documents constitutes "vol" (theft) though it does not fall within the scope of the formal definition of theft (because the ANSES was not deprived of the files).

Basically he was charged on three count: intruding in a private computer system, maintaining himself in said computer system, and theft of private documents.

The ruling said he was innocent of the first charge, since it was due to a security flaw, but guilty of the second, since he realized he was in a private system (he admitted to navigating the hierarchy and finding that the repository was "protected" by a login and password). He was also ruled guilty of the theft (the author of the blogpost, an attorney, says he should have been charged with counterfeiting instead, since that is the proper indictment for copyright violations).

Tldr: he's not fined for entering on the website. He's fined because he kept mirroring the site after he realized it was opened by mistake (he unwisely admitted as much to the cops).

It's the digital equivalent of figuring out that a house isn't locked, and concluding it's OK to loot it.

To be fair, one of the party's own blog is hardly the most objective on the matter.

I don't get it, what are the mistakes?

He is a journalist, he wasn't found when he downloaded the files, but when he wrote about their content.

Leasing a server wouldn't have changed a thing in that specific case.

Anyway, bluetouff is well-versed in computer security and the co-founder of a VPN service, so I suspect the files weren't downloaded from a french IP adress.

That, exactly that.

If you have a secret document, when I come knocking on your door and ask for that document, you'll refuse to give it to me, or at least ask for something that convinces you that can access it. Nobody would be crazy enough to charge me by a crime if I ask you the document, and you give it to me without any kind of verification.

But now, configure a computer to do that exact thing, and suddenly you manufacture plenty of new criminals.

If you happened upon my 'protected' account with some mal-formed link, then saw the standard 'tweets are protected' message on my main page, you might be in a spot if you went back and save all those secret tweets. Under the interpretation being discussed anyway.

I don't know about France, but in many jurisdictions, a "reasonable person" standard is used. While I don't personally believe accessing publicly available files should be illegal in any case, I do think that in the situation as described (with the admission of traveling up the path hierarchy to find a login page), most "reasonable people" would indeed infer that the files were not intended to be publicly available.

Even if it was, this is ridiculous.

What kind of security let's you download documents without authentication?