The ruling is more complicated than that. If you can read french, I suggest you read Maitre Eolas' take on it [1].
[1] http://www.maitre-eolas.fr/post/2014/02/07/NON%2C-on-ne-peut...
[1] http://www.maitre-eolas.fr/post/2014/02/07/NON%2C-on-ne-peut...
http://bluetouff.com/2013/04/25/la-non-affaire-bluetouff-vs-... http://bluetouff.com/2014/01/10/cher-contribuable-je-te-dema...
One can then discuss whether this law is fair or not, whether things would have been different had Bluetouff not made this key admission, whether it is reasonable to consider that the login page was sufficient to indicate that the documents weren't intended to be public, and whether the 3000 EUR fine is balanced or not.
Meanwhile, Bluetouff has appealed the ruling to the Cour de cassation, France's last-resort court for civil and criminal cases, whose role is to break rulings where the law was not correctly applied (without discussing the findings, only the application of the law and the adequate forms). I do not think we know yet how Bluetouff will phrase his appeal, but Eolas estimates that there would be a possible way to attack the ruling based on the court's finding that Bluetouff's retrieving the documents constitutes "vol" (theft) though it does not fall within the scope of the formal definition of theft (because the ANSES was not deprived of the files).
Which countries will use that against you?
IE: You are required by law to answer questions/turn over passwords when suspected of such things. David Miranda being a recent and well known example.
You got a cite for that?
According to former White House Counsel Alberto Gonzales (later the former attorney general), “[t]he stream of intelligence would quickly dry up if the enemy combatants were allowed contact with outsiders during the course of an ongoing debriefing.” Warren Richey, “Beyond Padilla Terror Case, Huge Legal Issues,” Christian Science Monitor, August 15, 2007, http://www.csmonitor.com/2007/0815/p01s08-usju.html. Yoo also explains that introducing a lawyer immediately after capture of an enemy combatant would disrupt interrogation as any competent defense counsel would tell his/her client to remain silent. Yoo, War by Other Means, 151.
But this also happens to immigrants or those stopped at the border in general. [0] The right to counsel is being eroded at the edges (apparently not applied to non-citizens whenever possible).
Over the past year, the American Immigration Council, along with the American Immigration Lawyers Association (AILA), has documented instances where the DHS immigration agencies—Customs and Border Protection (CBP), Immigration and Customs Enforcement (ICE), and U.S. Citizenship and Immigration Services (USCIS)—have deprived noncitizens of access to counsel. For example, ICE also has taken the position that there is no right to consult with a lawyer during an interrogation. Likewise, many CBP offices outright deny access to all lawyers. [1]
[0] http://law.psu.edu/_file/Immigrants/LAC_Right_to_Counsel.pdf
[1] http://immigrationimpact.com/2012/01/23/its-time-to-improve-...
Do we know how he accessed the documents? Did he crawl the directory with a login or without a login (meaning the directory is not protected)?
And why would he share such document with his fellow writer? What for?
The fact that a judge can't comprehend technical explanation according to the article seems to be the main issue here. Was he given a fair hearing?
We have pretty much the same law in the Netherlands. What I understand (IANAL), this goes as far as observing an open WiFi access point with the SSID named "UNAUTHORIZED ACCESS PROHIBITED", if you willingly connect to it (ignoring the message), you'll be in violation.
This is of course not security, and maybe it's kinda stupid, but the rule is also pretty clear and pragmatic. It's analogous to having a door with a "NO ACCESS" sign on it, even if it turns out to be unlocked, you're still not supposed to go there. Often such a sign will cite "Article such and such from the Book of Criminal Law Code" in smaller letters (Dutch people will know what type of signs I'm talking about), but afaik this is not necessary for the legal power of such a sign.
Although I'm not sure the correct word here is "hacking". Law and government should stop using the word to mean "any adept use of computer knowledge or skills that result in undesirable effects for some party". That could be used to accuse anyone with a computer and an opinion. There needs to be a proper legal definition (similar to how we distinguish between degrees of murder, manslaughter and involuntary homicide).
Compare "They just used the Windows Remote Access feature/You just changed the document_id part of the URL" to "You just dropped that coin in your pocket".
The line between "hacking" and "expected behaviour" can get very blurry, the more knowledgeable a person is. And in the end, like with magic tricks vs con men, it's the intent that makes it right or wrong (IMO).
The ruling said he was innocent of the first charge, since it was due to a security flaw, but guilty of the second, since he realized he was in a private system (he admitted to navigating the hierarchy and finding that the repository was "protected" by a login and password). He was also ruled guilty of the theft (the author of the blogpost, an attorney, says he should have been charged with counterfeiting instead, since that is the proper indictment for copyright violations).
It's the digital equivalent of figuring out that a house isn't locked, and concluding it's OK to loot it.
I think it's the equivalent of going down a public road and passing through a gate that was left open, onto private property.
While driving, off in the woods beside the road you notice a "no trespassing" sign, but it's not obvious that you're trespassing currently, even if you start to wonder.
A place on the disk was accessed that was unintended.
He's admitted that he kept snooping around after he fully realized that the files were online by mistake.
Besides, counterfeiting one's furniture doesn't cause any embarrassment. I'd rather equate it to photocopying your secret business plan, or your collection of naked self-pictures.
they can follow your transaction with the company once they find out, but it's going to be a little more difficult.
Leasing a server wouldn't have changed a thing in that specific case.
Anyway, bluetouff is well-versed in computer security and the co-founder of a VPN service, so I suspect the files weren't downloaded from a french IP adress.