Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Found a leak of US citizens personal data. Should I report it?

news.ycombinator.com

Post reply on HN
Print view View original

21–30 of 85 posts

Re: Ask HN: Found a leak of US citizens personal data. Should I report it?

#21

Post by exikyut »

oefrha wrote: post #12
exikyut wrote: post #8

Earlier quoted context omitted.

How about this for an idea: 1. Find the least-incriminating/reputationally damaging records within whatever quantum of the data you are prepared to look at 2. Make a website (with a landing page like for security bugs >.>), Tor site, pastebin dump or whatever else that seems reasonable 3. Publish 1-10% of the data (!) 4. Encourage the site to do the news rounds 5. Explicitly email the company to be concretely sure th…

Take this advice if you want to make sure you have a good chance of ending up arrested. That is to say, don’t. Your opsec is always poorer than you think it is. Just send an anonymous tip to Brian Krebs or similar if you want to do the noble thing.

Mmmm. Yeah the above is my lack of experience talking hehe. The very last thing to take armchair advice on lol

Re: Ask HN: Found a leak of US citizens personal data. Should I report it?

#22

Post by yeahsure »

anonymouskimmer wrote: post #2

I would try reporting it to the company, maybe also the FBI or FTC, or if you aren't too comfortable contacting them, you can try also contacting someone like Brian Krebs who presumably knows who to contact about data leaks of this nature. (Krebs' contact form: https://krebsonsecurity.com/about/ )

There are so many possible bad outcomes that can result from these options. Not a good idea at all imho.

Re: Ask HN: Found a leak of US citizens personal data. Should I report it?

#23

Post by jasonhansel »

exikyut wrote: post #8
g48ywsJk6w48 wrote: post #6

Earlier quoted context omitted.

I absolutely agree. It is unlikely that I will be thanked for such an act. Destroy the reputation of a company with 10+ years of experience on the market. And force dozens of other companies across the U.S. to apologize to their customers for leaking data. Not to mention lawsuits and fines for such a leak.

How about this for an idea: 1. Find the least-incriminating/reputationally damaging records within whatever quantum of the data you are prepared to look at 2. Make a website (with a landing page like for security bugs >.>), Tor site, pastebin dump or whatever else that seems reasonable 3. Publish 1-10% of the data (!) 4. Encourage the site to do the news rounds 5. Explicitly email the company to be concretely sure th…

https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act

Re: Ask HN: Found a leak of US citizens personal data. Should I report it?

#24

Post by lopatin »

exikyut wrote: post #8
g48ywsJk6w48 wrote: post #6

Earlier quoted context omitted.

I absolutely agree. It is unlikely that I will be thanked for such an act. Destroy the reputation of a company with 10+ years of experience on the market. And force dozens of other companies across the U.S. to apologize to their customers for leaking data. Not to mention lawsuits and fines for such a leak.

How about this for an idea: 1. Find the least-incriminating/reputationally damaging records within whatever quantum of the data you are prepared to look at 2. Make a website (with a landing page like for security bugs >.>), Tor site, pastebin dump or whatever else that seems reasonable 3. Publish 1-10% of the data (!) 4. Encourage the site to do the news rounds 5. Explicitly email the company to be concretely sure th…

> 3. Publish 1-10% of the data

What?

Re: Ask HN: Found a leak of US citizens personal data. Should I report it?

#25

Post by drdaeman »

berkle4455 wrote: post #5

Do not under any circumstances report the leak with your actual identity. If you want to do so anonymously, go for it. However that said, there is no upside in you reporting the leak, only downside potential.

> there is no upside in you reporting the leak

There is - not letting it be - raising awareness and contributing to prevention of a normalization of such things. If everyone would hold "let sleeping dogs lie"/"not my circus, not my monkeys" attitude it would gradually become a norm and this benefits no one (but possibly bad actors).

However, exercising caution never hurts, so it shouldn't be a bad idea to reach out anonymously and explicitly state that you have nothing to do with the issue at hand and merely an observer who had noticed its existence. Doing so through a trusted third party who are experienced (many names in comments already) with handling such situations is probably the best approach.

Re: Ask HN: Found a leak of US citizens personal data. Should I report it?

#26

Post by lucasyvas »

If it were me I'd honestly do nothing. History has shown it's equally likely to be a lose-lose scenario. Let it remain as-is.

If it's related to protecting children or a vulnerable group, maybe report it. Otherwise, whatever.

Either way, don't do it in a way that they know it was you who found it.

Re: Ask HN: Found a leak of US citizens personal data. Should I report it?

#27

Post by pushedx »

exikyut wrote: post #8
g48ywsJk6w48 wrote: post #6

Earlier quoted context omitted.

I absolutely agree. It is unlikely that I will be thanked for such an act. Destroy the reputation of a company with 10+ years of experience on the market. And force dozens of other companies across the U.S. to apologize to their customers for leaking data. Not to mention lawsuits and fines for such a leak.

How about this for an idea: 1. Find the least-incriminating/reputationally damaging records within whatever quantum of the data you are prepared to look at 2. Make a website (with a landing page like for security bugs >.>), Tor site, pastebin dump or whatever else that seems reasonable 3. Publish 1-10% of the data (!) 4. Encourage the site to do the news rounds 5. Explicitly email the company to be concretely sure th…

This is almost exactly the opposite of what you should do in this situation

Re: Ask HN: Found a leak of US citizens personal data. Should I report it?

#30

Post by vorpalhex »

nerdawson wrote: post #4

I'd question whether the potential blowback of doing the right thing is actually worth it. Some organisations will be grateful for your help and you get that warm feeling that comes with knowing you've helped to protect peoples data. But, when it goes wrong and you become the target of the organisation's ire, the personal consequences can be severe. Example: https://news.ycombinator.com/item?id=29745960

Proceed anonymously. Make sure the cost to identify you exceeds the theoretical damage of the hack.
Post reply on HN