1.) If it was made in the US, probably not. Reading the memory of a webserver would be pretty easy for a lawyer to argue is "unauthorized use of a computer system." That is the basic definition presented in the Computer Fraud and Abuse Act.
2.) I don't know enough to be able to argue one way or another on this point. However, if you download the list or disseminate the list you are likely increasing your possible exposure.
2.) I don't know enough to be able to argue one way or another on this point. However, if you download the list or disseminate the list you are likely increasing your possible exposure.