Your analogy, for the record is wrong. Completely wrong in fact. But enough with the analogies. We have 20 years of mainstream HTTP usage. We know how it works. Authorization over HTTP is a solved problem and can be done in multitudes of ways, trivially. If he's breaking the law than so is Google millions times over because there are a shit ton of indexed pages that technically Google wasn't authorized to crawl. If your web server is configured to fulfill all anonymous requests, then you are implicitly granting the authorization to access this data. This is the way HTTP was designed. That's the only way this all makes sense, otherwise youtube can change their TOS to make every person who views a video a criminal.