The underlying issue here is that there is no national legal standard for responsible disclosure. ...and with all the news of foreign ransomeware gang causing

The underlying issue here is that there is no national legal standard for responsible disclosure. ...and with all the news of foreign ransomeware gang causing havoc, prosecutors and politicians are HUNGRY to prosecute "hackers". My advice to a client would be not to disclose any vulnerability on a government system, due to the unfortunate legal liability. ...and if they did feel the need to disclose (which I admire), to do so anonymously to a 3rd party security researcher with the history and reputation for that sort of work (ie a reputation that even an old IT-clueless judge cannot deny). Don't put yourself in the cross-hairs of some overzealous prosecutor who wants to show his boss/party/public that he's the one prosecutor that busted a bunch of evil hackers.