@jmoreno, Legally I concede that you MAY be correct, although this conviction would indicate that the court disagrees. Your rationale, however, is morally bankrupt.

@MichaelHall: he wasn’t convicted of trickery he was convicted of violating the CFAA, which, as I said, makes using a computer in a way the owner doesn’t like, a crime. No prior notice or efforts to prevent you from so using the computer is required.

A “unique iPad Id” doesn’t assert ownership of either the iPad or the information, but as far as the CFAA is concerned that is irrelevant. In fact, whether it was his iPad Id or someone else’s was irrelevant, his usage was in a manner that they didn’t like, and THAT, not the fact that he supplied someone else’s “Id” is what made it a violation. The URL was “meant” to only be called from within their app, the publicly accessible url was not supposed to be known,

So, while accessible without any special tools or methods, doing so was a crime. Could have sent you a link, with your Id, then you clicking on the link would make you a criminal. I think that is wrong and reprehensible, feel free to disagree.

@jmoreno, Technically, when he changed the number in the URL, he was abusing an exploit he discovered in somebody else's system, which is essentially what hacking is in the first place.

@jmoreno, I didn't claim he was convicted of trickery, or spoofing, or hacking. Instead, he used those techniques to accomplish a theft of personal information. This goes way beyond using a computer in a "manner that they didn't like".

@TylerSelden: I wouldn’t call it an exploit because there was no effort made to secure it.

@TylerSelden: when you have to login and then can see someone else’s info by changing the url, I would call that an exploit. If the link was sent and then time limited, I would call it an exploit, but a “secret” PUBLIC url? Hoping that people don’t stumble across it isn’t security.