“Attack” is not a legal term
Neither is “use” or “exploit”. When someone is charged with a crime, the state makes very specific which crime(s) the accused has committed and, from that flow the elements that the state must prove beyond reasonable doubt.
Arkansas no doubt has laws about this but since it’s being “investigated by the FBI” the suspicion is that a Federal crime was committed. Of course, “under investigation” just means that someone told the FBI about it, whether the FBI does anything is up to them. As the TV show Yes, Minister put it “under consideration” means we’ve lost the file, “under active consideration” means we’re looking for it.
The most relevant Federal law is the Computer Fraud and Abuse Act (CFAA) under which there are a number of crimes but the most applicable is:
(2) intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains—
(C) information from any protected computer;
The person in the article:
- intentionally - check
- accessed a computer - check
- without or exceeding authorisation - we’ll get back to this
- obtained information - check
- from a protected computer - check. Any computer with internet access is a “protected computer” under the Act and this includes mobile phones.
So the only question is did the person not have authorisation or exceed the authorisation they had?
It’s clear that they were not explicitly authorised.
Publishing something with a URL and *without any security *on the web is possibly implicit authorisation. For example, you are authorised to access this web page whether you are a signed up member of Stack Exchange (SE) or not.
However, down at the bottom of this page is a Legal link which may create a binding contract between you and SE (see https://law.stackexchange.com/a/13571/344). The CFAA is drafted so broadly that breach of a contract may trigger criminal sanctions (see the sad case of Aaron Schwartz. Criminal sanction for a civil wrong is ... odd ... but not prohibited by the legal system - government has the power to decide what is and isn’t a crime.
As it currently stands the CFAA is a wide-reaching and draconian piece of legislation. There is a line but if you start to think you might be crossing it, you are probably already well over it.