I can help but think about the following point when looking at this. Do people really care whether access was direct or indirect if their own personal records have all been captured and/or seen/analyzed? It sure wouldn't matter to me how they pried their way in - it would matter to me that they had done it though.
