Remember the guys who found that AT&T was publicly showing iPad user email addresses (in the clear, without any authentication) on its website? One of them wro

Remember the guys who found that AT&T was publicly showing iPad user email addresses (in the clear, without any authentication) on its website? One of them wrote a script to visit a series of URLs on that site, incrementing a number at the end of the url each time, and collecting those email addresses. Then he used the emails to publicize AT&T's info leak. The script just visited publicly visible web pages and collected some information from them. The guy who wrote the script was convicted under the CFAA (the same law used to prosecute Aaron Swartz) of conspiracy to access AT&T’s computers without authorization. So, what's authorization? If visiting a publicly accessible web page can constitute unauthorized access, then your hypothetical is indeed the case, e.g.: http://cfaadefensefund.com/ http://cfaadefensefund.com/