2

Bob has a website that he hosts online and is open to the public. A portion of the site has "members only" data. However, Bob implemented his security protection of this sensitive data incorrectly. So when Alice clicks the link to view the protected data, instead of being prompted to login or sign up. She just gets access to the data.

Has Alice broken the law if she unintentionally views/downloads the members only data?

4
  • The link itself, is it already visible/clickable by everybody? Or does someone need to assemble the link before it can be followed?
    – Greendrake
    Mar 7, 2023 at 23:55
  • @Greendrake Its clickable by everybody but the function that triggers the security mechanisms is broken/missing. Mar 8, 2023 at 0:04
  • 1
    So what should happen is that I click on the button and get shown a login screen and after login I see the material. The login screen would tell me that I’m unauthorised AND stop me from viewing. If I could hack my way in I would still be unauthorised. But the login screen isn’t shown and I can view the documents.
    – gnasher729
    Mar 8, 2023 at 10:44
  • 2
    It is absolutely critical that Alice did not realize the data was supposed to be members only. Mar 10, 2023 at 16:10

1 Answer 1

3

The most apparent potential offences would be under 18 U.S.C. § 1030, but these require the mens rea of "knowingly" or "intentionally" doing things without authorization, or doing so "with intent to defraud", etc. See also the Department of Justice's manual entry on this family of offences. Particularly relevant is this quote:

As part of proving that the defendant acted knowingly or intentionally, the attorney for the government must be prepared to prove that the defendant was aware of the facts that made the defendant’s access unauthorized at the time of the defendant’s conduct.

Given your stipulation that the person has unintentionally viewed or downloaded the material without authorization, this would not be a violation of 18 U.S.C. § 1030.

3
  • 1
    I think the person did intentionally view the material, but due to the website design and broken software they had no suspicion at all and couldn’t have any suspicion that someone didn’t want them to.
    – gnasher729
    Mar 8, 2023 at 10:39
  • 1
    There is US case law to the effect that "knowingly" has narrow scope, eg "knowing to be false in a federal matter" is about knowing to be false, and not knowing to be federal.
    – user6726
    Mar 10, 2023 at 15:21
  • The answer would be the same in England and Wales - and it doesn't seem worth adding a whole new answer just to same "same". Mar 10, 2023 at 16:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .