4 ms·
About 10 years ago, I stumbled across a local government website that leaked personal information about all registered citizens (including full names, civil id
by guug 7y ago
About 10 years ago, I stumbled across a local government website that leaked personal information about all registered citizens (including full names, civil id numbers, dates of birth, academic grades, etc). I didn't report it because I knew they would try to go after me.
Fast forward to last year, the government decided to double down on their stance by making punishments harsher than most crimes of violence without carving exemptions for white hat researches.
Unsurprisingly, my country's infrastructure was shown to be completely compromised by Snowden's (or Manning's) leaks.
- Aperocky 7y agoPunishment will not stop anyone - they won't find anyone to punish. It will simply lead to everything getting leaked and sold underground.
- Brave-Steak 7y agoI don’t know if this is a real option, but did you consider anonymously leaking it to the press?
- cesarb 7y agoIf you "stumbled across a local government website", you cannot "anonymously leak" it anymore, since your IP address is already on the web server's logs. After an "anonymous leak", it's the first place they'll look. The only good alternative is to keep quiet, and pray that nobody else finds it and anonymously report it to the press before the logs containing your IP address are rotated and deleted.
- moneywoes 7y agoWhat state if you don't mind me asking
- guug 7y agoNot in the US.
- parliament32 7y agoIf you're "stumbling" around without a VPN you deserve everything terrible that will happen to you. As a researcher you should know better.
- guug 7y agoI was a normal user who made a mistake when entering my own information. Government employees who think like you are the reason why security issues don't get reported. Don't make baseless assumptions.