While it seems reasonable to presume that non-password protected files can be freely accessed until one learns otherwise, it's doesn't seem reasonable to continue presuming this after reading an explicit prohibition. Is there a legal requirement that says one must attempt to physically restrict access if one wants to assert usage restrictions?
I presume if I had an unattended roadside vegetable stand with a cash-box, that I'd be able to prosecute someone who took vegetables without paying, certainly if they also made off with the cash-box. Why is this different on the web? And if a written prohibition has no legal standing, why do so many companies pay lawyers to write click-through "terms of service" agreements?
Let's go through what happens when I visit a web site. I type a URL in my bar, and hit enter. My web browser makes a request via http to a server, and the server inspects the request, determines if I should see the content or not, and returns either a 200 if I am allowed, and a 403 if I'm not. So, by viewing their pages, I'm literally asking permission, and being allowed.
It sounds to me like a misconfiguration of their server; it's not doing what they want it to.
Convention. The convention for the web is: if you can access it through normal means, then you are allowed to access it.
That a web server is an explicit, external interface is a technical reason. How we expect to use that interface is a social reason.
I think it's mostly based on society's expectations. It is generally understood that the merchandise at a roadside stand belongs to somebody and another person should not take possession of it, while it is generally understood that something posted online where everyone can see it was posted with the intent of letting everyone see it. Given that, it would make sense that posting something everyone can see implies a grant of permission for everyone to see it.
And if a written prohibition has no legal standing, why do so many companies pay lawyers to write click-through "terms of service" agreements?
IANAL, but I would expect the "click-through" part makes a difference. A visitor to the site may not see a simple written prohibition, whereas accepting the click-though agreement at least indicates acknowledgment that those rules are there (even if they turn out not to be enforceable).
Yes, but it seems fair to add "in the absence of evidence to the contrary". I think a clearly written prohibition would constitute such evidence.
whereas accepting the click-though agreement at least indicates acknowledgment that those rules are there
In this physical case, in order to assert usage restrictions (i.e. this is not a road), one must physically restrict access even if temporarily and infrequently.
This from a common law doctrine that makes private roads public rights of way. It must be blocked off one day per year to prevent it becoming a public right of way. Once it's a public right of way it's really hard to make it private again, it must be unused for 7 years or something.