>Shouldnt public disclosure be the first thing which is protected? Largely, this depends on your perspective of whether or not the entity (or government body)

>Shouldnt public disclosure be the first thing which is protected? Largely, this depends on your perspective of whether or not the entity (or government body) should be allowed to make a good-faith effort to rememdy/rectify/fix the egregious behaviour before you go running to the media. It's the same principle behind CVD (Coordinated Vulnerability Disclosure).