I've been getting into cyber security and learned there are certain sites that have their directory browsing enabled, like a URL that contains the files/folders of a site that contain content, which means you can go back a few directories and possibly see stuff like photos of content that you would have had to pay for browsing the site normally or even sensitive information like photos of user's ID's.

Is it even legal to view those files (U.S), since anyone with a browser and the right URL can access them?


If the operators of a site post them in such a way that anyone with a browser can access them, with no login or other security precaution required, and not even any notice that the files are confidential, they are implicitly inviting anyone to view them, and thus it is legal to do so.

There was a case where a site owner gave specific notice to a user not to access the site, and blocked the user's IP. When the user hired a proxy service to get around the blockage, this was held to be unauthorized access, a crime under the CFAA (Computer Fraud and Abuse act). But in that case the individual notice was considered essential to the applicability of the act.

That case was Craigslist, Inc v. 3Taps, Inc et al, 942 F.Supp.2d 962 (N.D. Cal. 2015). See also This Wikipedia article and thisJaxEnter article. As the Wikipedia article put it:

Craigslist Inc. v. 3Taps Inc., 942 F.Supp.2d 962 (N.D. Cal. 2013) was a Northern District of California Court case in which the court held that sending a cease-and-desist letter and enacting an IP address block is sufficient notice of online trespassing, which a plaintiff can use to claim a violation of the Computer Fraud and Abuse Act.

Note that in this case web scraping was apparently impacting the craigslist site.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.