Yes. It was a public webpage. They sent a normal request and received a normal response. That response just so happen to contain Base64 encoded SSNs in the page

Yes. It was a public webpage. They sent a normal request and received a normal response. That response just so happen to contain Base64 encoded SSNs in the page state. There's no actual legal merit to any argument that this was unauthorized computer access. Suggesting that decoding base64 is somehow "hacking" is nonsense.