The two situations are very different. As technology goes, Aaron merely accessed what was already accessible to every user. Uber accessed information a single

The two situations are very different. As technology goes, Aaron merely accessed what was already accessible to every user. Uber accessed information a single user wouldn't have had access to. As ethics go, Aaron downloaded information that represented publicly funded research and would be available to the public if academic publishing wasn't so horribly defunct. Uber extracted operative business information that was only meant to be exposed a fraction at a time to provide specific services. As motives go, Aaron tried to make information publicly available for free. Uber tried to poach Lyft's drivers and sabotage Lyft's operational model for financial gain. The only value of Aaron's case in this discussion is as an example in the form of "If what Aaron did was grounds for criminal prosecution, how is what Uber did not a federal crime?". Even if you disagree with the ethical aspects, Aaron exfiltrated information available to any normal user (just at a larger scale than intended) whereas Uber intentionally exploited a design flaw to access information not available to any individual user. If both crimes could be described as "doing X, and then doing the same thing again a lot more times" for Aaron X was "downloading a file intentionally made available to all users" whereas for Uber X was "downloading information only intended to be available to a single other user".