Yes it's the ethical thing to report it. Do you know how many people get harassed by stalkers every year in the US? I wouldn't put your name on the report though, just report anonymously.
Ask HN: Found a leak of US citizens personal data. Should I report it?
11–20 of 85 posts
Re: Ask HN: Found a leak of US citizens personal data. Should I report it?
#12Earlier quoted context omitted.
I absolutely agree. It is unlikely that I will be thanked for such an act. Destroy the reputation of a company with 10+ years of experience on the market. And force dozens of other companies across the U.S. to apologize to their customers for leaking data. Not to mention lawsuits and fines for such a leak.
How about this for an idea: 1. Find the least-incriminating/reputationally damaging records within whatever quantum of the data you are prepared to look at 2. Make a website (with a landing page like for security bugs >.>), Tor site, pastebin dump or whatever else that seems reasonable 3. Publish 1-10% of the data (!) 4. Encourage the site to do the news rounds 5. Explicitly email the company to be concretely sure th…
Take this advice if you want to make sure you have a good chance of ending up arrested. That is to say, don’t.
Your opsec is always poorer than you think it is.
Just send an anonymous tip to Brian Krebs or similar if you want to do the noble thing.
Re: Ask HN: Found a leak of US citizens personal data. Should I report it?
#13Maybe tell someone like Troy Hunt from haveibeenpawned. He has a pretty good reputation/following for verifying this kind of thing and telling the right people.
I came into here to offer the same advice, that's exactly what their specialty is.
Re: Ask HN: Found a leak of US citizens personal data. Should I report it?
#14[deleted]
Re: Ask HN: Found a leak of US citizens personal data. Should I report it?
#15Ask if they have a bug bounty program first. From ProtonMail.
Re: Ask HN: Found a leak of US citizens personal data. Should I report it?
#16I would try reporting it to the company, maybe also the FBI or FTC, or if you aren't too comfortable contacting them, you can try also contacting someone like Brian Krebs who presumably knows who to contact about data leaks of this nature. (Krebs' contact form: https://krebsonsecurity.com/about/ )
Please do not ever communicate directly with anyone from a federal law enforcement agency. Only talk to them through an attorney. They are most definitely not on your side.
Re: Ask HN: Found a leak of US citizens personal data. Should I report it?
#17I would try reporting it to the company, maybe also the FBI or FTC, or if you aren't too comfortable contacting them, you can try also contacting someone like Brian Krebs who presumably knows who to contact about data leaks of this nature. (Krebs' contact form: https://krebsonsecurity.com/about/ )
Please do not ever communicate directly with anyone from a federal law enforcement agency. Only talk to them through an attorney. They are most definitely not on your side.
I can second this. My attorney says I can't talk much more about it.
Re: Ask HN: Found a leak of US citizens personal data. Should I report it?
#18[dead]
Re: Ask HN: Found a leak of US citizens personal data. Should I report it?
#19I'd question whether the potential blowback of doing the right thing is actually worth it. Some organisations will be grateful for your help and you get that warm feeling that comes with knowing you've helped to protect peoples data. But, when it goes wrong and you become the target of the organisation's ire, the personal consequences can be severe. Example: https://news.ycombinator.com/item?id=29745960
Probably the best advice in this thread so far (better than mine, I think, at least) is
https://news.ycombinator.com/item?id=34934091
It's an approach that's specifically calculated to minimize the blowback.
Re: Ask HN: Found a leak of US citizens personal data. Should I report it?
#20I would try reporting it to the company, maybe also the FBI or FTC, or if you aren't too comfortable contacting them, you can try also contacting someone like Brian Krebs who presumably knows who to contact about data leaks of this nature. (Krebs' contact form: https://krebsonsecurity.com/about/ )
[deleted]