That’s a very weak argument. If I’m walking down the street at night and somebody comes up to me and says “GET /money”, I may respond with an HTTP 200, but that doesn’t mean the person didn’t just steal from me.
Coercion can be the difference between asking for money and theft. In the case of this intel data, it was clearly coerced from a server - it's not like it was linked on Google, they had to specially craft URLs to coerce the data out.
1. Find the server via nmap
2. Guess at some URLs until the server finally responded with some hidden data.
While neither of those would require being an expert in the field, this is well beyond the realm of browsing public websites.
The key here is that these services were not advertising their presence.
There are often ways to beaches and other spaces unadvertised, but otherwise OK to use.
Sure looks to me like a potential landmine for people. Bad practice with big pockets should still just be bad practice with the same consequences for all who don't bother with better practices.
There was no lock on this at all.
That did not happen here. Theft is not part of the discussion.
Infringement could be, and is at least the right language for the discussion.
There is zero theft in this discussion.
One could argue there was infringement, and that argument is very difficult to make without breaking the Internet for everyone just because someone with deep pockets failed.
Coercion involves, at the core, an act of agency performed to the intent of someone else, who is not the agent, actor.
Bad practice does not support coercion at all.
I wonder whether that word even applies to entities lacking agency.
Servers are automatons. They do not make value judgements and or creative acts of agency of any kind.
We need these things as a basis for coersion.
There are lots of things not indexed by Google and it is dangerous to imply people are somehow wrong when data is accessed sans a Google index.
Security by obscurity does not make sense. This mess is part of why.