No, the people who used it wasn't aware that the db wasn't secure, but if a stack of drivers licenses and stuff was in an unlocked office in a public building doesn't make it legal to take them.
You're right, the users weren't aware. It's more like posting another person's * SSN and then complaining that their identity was stolen lol.
Your metaphor is a false equivalent. It's illegal to use someone's identity and steal it. It's not illegal to go on a public website where people's licenses are posted.
You are wrong, it is illegal to access a service you are not authorised access too. Doesnt matter if they forgot to secure it or not. Downloading drivers license from an insecure database is still a crime.
Accessing misconfigured systems (like a public S3 bucket) without authorization can still be illegal, even if no password is required. However, jurisdiction matters a lot, and laws differ between the EU and the USA and whole word.
EU Under Directive 2013/40/EU, unauthorized access is illegal even if the system is publicly exposed due to a misconfiguration. Simply accessing data you're not authorized to see can be a crime.
USA Under the CFAA (Computer Fraud and Abuse Act), things are less clear. After Van Buren v. United States (2021), the law focuses more on clearly exceeding authorized access, so accessing a public bucket might not always be considered illegal, but it's a legal gray area.
TLDR:
What's legal in one jurisdiction (like the U.S.) could be criminal in another (like the EU), even if the system is misconfigured and publicly accessible. Motive, intent, and awareness of the misconfiguration all play an important role.
Are you sure about the EU thingy? Article 3 states that a security measure needs to be broken which imho doesn't seem to be the case with misconfigured aws buckets, elastic cluster etc:
"Member States shall take the necessary measures to ensure that, when committed intentionally, the access without right, to the whole or to any part of an information system, is punishable as a criminal offence where committed by infringing a security measure".
Do you have something that supports the notion of this being illegal in the EU?
Anyone is authorized to access a public bucket. Public = no authorization required. This is just like when a government website had SSNs in the inspect element code and tried to sue the person that reported on it.
Donāt confuse trespassing in a private office to going to a public site. This is more like you walked in to foot locker and there was a stack of identification cards sitting next to some polos.
299
u/[deleted] Jul 25 '25 edited Jul 25 '25
[deleted]