So? Your criminal liability for incrementing the URL is totally situational. If you're reading a catalog and you tick the URL to see what the next product is, you aren't going to be liable. If you see a URL used for XHR in the frontend for your bank and you increment it to see other people's bank accounts, you will be.
We don't have a law against "hacking" in the US; we have a law against "unauthorized access", particularly when that access has consequences.
According to one recently tried case, by the way, and one where the sentence was ultimately vacated.
And finally: CISA has almost nothing to do with criminal law (it defines no new offenses does not change CFAA or its sentencing). If you want to have a discussion about how totally broken CFAA's sentencing is, I'm right there with you.
All I'm suggesting is that since CFAA has a history of been construed to be applicable in extremely broad-terms by prosecution and (although I have not done a close reading of the entire act it contains provisions such as the following in it's definition of CYBER THREAT INDICATOR):
> (D) a method of causing a user with legitimate access to an information system or information that is stored on, processed by, or transiting an information system to unwittingly enable the defeat of a security control or exploitation of a security vulnerability;
That OP's second concern:
> and I don't want my geolocation, etc. perpetually in the hands of anyone with a security clearance.
Regarding being under surveillance for what they may consider to be their normal or otherwise professional activities is quite valid.
We don't have a law against "hacking" in the US; we have a law against "unauthorized access", particularly when that access has consequences.
According to one recently tried case, by the way, and one where the sentence was ultimately vacated.
And finally: CISA has almost nothing to do with criminal law (it defines no new offenses does not change CFAA or its sentencing). If you want to have a discussion about how totally broken CFAA's sentencing is, I'm right there with you.