According to news reports, arrests have already been made in relation to the Heartbleed bug. It sounds like this person managed to gain access to the website's database by capturing the credentials the app used to access the database. This person then apparently used those credentials to access the database.
My question is, what part is illegal here? He was charged with "one count of unauthorized use of a computer and one count of mischief in relation to data." So, is it illegal to send a heartbeat request to a server knowing that the request will result in data leakage? If that data contained nothing but random bits, would it still be illegal or must it contain sensitive data to become illegal? Say passwords or other such info was present, does it then become illegal to have done it? Or does it become illegal to then take those credentials and log into a public-facing admin interface to the database?
What I'm confused about is where is the line between illegal hacking and just using information which is publicly visible? If a website leaves its DB credentials on its homepage with a link to a phpMyAdmin frontend to that DB, is it illegal to log in and look around?
At risk of asking multiple and broad questions which will lead to this question being closed, are there any rules of thumb to abide by when curious snooping around to see how something works crosses the line to become illegal?