The Computer Misuse Act 1990 makes it an offence in the UK to try and access programs or data on computers when that access is unauthorised. As I understand it in the US the Computer Fraud and Abuse Act similarly makes such access an offence, again if the access is unauthorised.
From google, which references the Oxford English Dictionary unauthorised means "not having official permission or approval". However it seems this cannot be the meaning in law, as I have never received official permission or approval to access any site on the internet including this one. I would assume that there is some implicit authorisation that everyone has to access this and other sites.
Where this assumption would seem to be stretched is when one accesses sites that are less obviously supposed to be accessed by everyone. An example of such access is the "hack" of the airlines website to access the US no-fly list. Here the initial access was to a development version of the airlines web site indexed by shodan. A lot of information was available without any credentials, and apparently sometimes anonymous admin access is granted. In this particular case Amazon credentials were publicly available. These credentials allowed access to the TSA no fly list from 2019.
It is not obvious to me how much of this was "unauthorised". One might assume that information that is publicly available would be OK to use, but information behind a login would not, even if the login credentials were publicly available. However I do not have a good reason for that assumption.
What is the legal definition of unauthorised in this case? Answers for any jurisdiction would be interesting, as the internet is pretty international an one never really knows where the computer you are interacting with really is.
