The distribution of the SSNs to the client, where they can be seen by everyone using a Web browser by clicking on a standard menu function is clearly the govern

The distribution of the SSNs to the client, where they can be seen by everyone using a Web browser by clicking on a standard menu function is clearly the government's fault. They are obviously trying to deflect their incompetence - nobody audited the design nor the resulting implementation. If the journalist acted as described it is professional behavior (notify and postpone publication to give the Website operator a chance to fix things), it is ethical and complies with security disclosure best practices.