Should it be illegal? They shared a public link to a spreadsheet exposed on a .gov address. If anything, it's the owner of that .gov address that needs to get in trouble for placing sensitive documents in a publicly accessible ___location.
I think I read that differently. I read it that they gathered the data, put together the spreadsheet and hosted on a .gov address. Is there an article that is more clear about that?
