Interestingly enough, how do rapid 7 think that they're able to do this sort of thing? It goes against Amazon's terms of service and AUP, not to mention against

Interestingly enough, how do rapid 7 think that they're able to do this sort of thing? It goes against Amazon's terms of service and AUP, not to mention against the people who have the data in insecurely configured buckets. In light of Weev's sentencing and the sad case of Aaron Swartz, is there one law for security companies and one law for individuals? I appreciate that one can say they're carrying out important research, but did they notify the people with open buckets or are they more interested in PR?