united-states internet
Is it illegal to download data from a misconfigured server that is open to the public?
<p>Bob has a website that he hosts online and is open to the public. A portion of the site has &quot;members only&quot; data. However, Bob implemented his security protection of this sensitive data incorrectly. So when Alice clicks the link to view the protected data, instead of being prompted to login or sign up. She just gets access to the data.</p>
<p>Has Alice broken the law if she unintentionally views/downloads the members only data?</p>

<p>The most apparent potential offences would be under <a href="https://uscode.house.gov/view.xhtml?req=(title:18%20section:1030%20edition:prelim)" rel="nofollow noreferrer">18 U.S.C. § 1030</a>, but these require the <a href="https://en.wikipedia.org/wiki/Mens_rea" rel="nofollow noreferrer"><em>mens rea</em></a> of &quot;knowingly&quot; or &quot;intentionally&quot; doing things without authorization, or doing so &quot;with intent to defraud&quot;, etc. See also the Department of Justice's <a href="https://www.justice.gov/jm/jm-9-48000-computer-fraud" rel="nofollow noreferrer">manual entry</a> on this family of offences. Particularly relevant is this quote:</p>
<blockquote>
<p>As part of proving that the defendant acted knowingly or intentionally, the attorney for the government must be prepared to <strong>prove that the defendant was aware of the facts that made the defendant’s access unauthorized at the time of the defendant’s conduct</strong>.</p>
</blockquote>
<p>Given your stipulation that the person has <em>unintentionally</em> viewed or downloaded the material without authorization, this would not be a violation of 18 U.S.C. § 1030.</p>
