If the scenario being proposed is that the reporter publicly searched teachers on the site and then noticed that SSNs were returned in hidden HTML or an endpoin

If the scenario being proposed is that the reporter publicly searched teachers on the site and then noticed that SSNs were returned in hidden HTML or an endpoint returned it from an API directly, that is a facepalm and they’re fine. If the reporter searched teachers and located (for example) their teacher ID, then discovered an endpoint (from looking at the JS) that took the ID as input and returned an SSN, they have potentially violated the CFAA (as written). Do I agree that they should be prosecuted? No. Is the CFAA a terrible law that criminalizes most netsec research? Yes.