Teenager facing prison for downloading unsecured files from government website

I wonder how they noticed.

Perhaps the lowest-bid contract company that made the site decided to use something like amazon glacier for storage of boring documents nobody will ever need. Then along comes someone that causes them all to be extracted at great cost, some middle manager receives a bill for $millions and wants to blame the kid rather than his own failings.

Seems like a move by the provincial government to shift blame from its poor security to an imaginary bad actor; this article also from the CBC goes into more detail and asserts that fraudulent intent is necessary for a conviction, so hopefully this goes nowhere.

http://www.cbc.ca/news/canada/nova-scotia/concerns-teen-bein...

The teenager was downloading publicly available records on a Freedom-Of-Information portal. Why law enforcement is involved, or why this is even remotely a criminal act, completely baffles me.

Add "help avoid sending teenagers to prison" to the list of reasons why you should prefer UUIDs over integers in your Internet-facing REST API.

This API was supposed to be private and yet supported trivial enumeration?

If you can see the data by iterating a single number in a URL, and there's zero authentication or verification of credentials, there's no possible way to call it malicious. The fact this family's home was raided was already a colossal mistake. The fact charges are even _suggested_ is such a joke I don't even have words to describe it.