Correct me if I'm wrong but it wasn't publicly available in the sense that it was linked to from some publicly facing website. I'm understanding that they found

Correct me if I'm wrong but it wasn't publicly available in the sense that it was linked to from some publicly facing website. I'm understanding that they found some URL scheme that spit out these records. So quite an edge case. People have been prosecuted for stealing data from unsecured s3 buckets too. If you could reasonably infer that you're not supposed to have access, try to obtain it and then go on to share that data with the media (which only acknowledges you know you're not supposed to have it) then I don't see a huge problem with prosecuting it. Usually by scraping I understand accessing something that's already being accessed by clients and you're merely automating what's already happening. Now if someone inadvertently obtained this kind of data without trying (say part of a bigger scrape) and didn't use or distribute it then obviously I don't want to see that prosecuted. And I doubt it would be.