The Computer Fraud and Abuses Act is incredibly broad, it's basically impossible to prove a vulnerability like this exists without violating it.
It's of course NOT legal … I've just reported the video to Google.
I've just reported the video to Google sounds like a dirty, dirty euphemism
It's amusing (and sad) that while the NSA monitors all emails and every single phone calls of all Americans, but still fails to detect and prevent a computer intrusion of this magnitude into Americas largest company.