About 10 years ago, I stumbled across a local government website that leaked personal information about all registered citizens (including full names, civil id numbers, dates of birth, academic grades, etc). I didn't report it because I knew they would try to go after me.
Fast forward to last year, the government decided to double down on their stance by making punishments harsher than most crimes of violence without carving exemptions for white hat researches.
Unsurprisingly, my country's infrastructure was shown to be completely compromised by Snowden's (or Manning's) leaks.
I was a normal user who made a mistake when entering my own information. Government employees who think like you are the reason why security issues don't get reported.
If you "stumbled across a local government website", you cannot "anonymously leak" it anymore, since your IP address is already on the web server's logs. After an "anonymous leak", it's the first place they'll look.
The only good alternative is to keep quiet, and pray that nobody else finds it and anonymously report it to the press before the logs containing your IP address are rotated and deleted.
Comments
About 10 years ago, I stumbled across a local government website that leaked personal information about all registered citizens (including full names, civil id numbers, dates of birth, academic grades, etc). I didn't report it because I knew they would try to go after me.
Fast forward to last year, the government decided to double down on their stance by making punishments harsher than most crimes of violence without carving exemptions for white hat researches.
Unsurprisingly, my country's infrastructure was shown to be completely compromised by Snowden's (or Manning's) leaks.
Punishment will not stop anyone - they won't find anyone to punish.
It will simply lead to everything getting leaked and sold underground.
If you're "stumbling" around without a VPN you deserve everything terrible that will happen to you. As a researcher you should know better.
I was a normal user who made a mistake when entering my own information. Government employees who think like you are the reason why security issues don't get reported.
Don't make baseless assumptions.
What state if you don't mind me asking
Not in the US.
I don’t know if this is a real option, but did you consider anonymously leaking it to the press?
If you "stumbled across a local government website", you cannot "anonymously leak" it anymore, since your IP address is already on the web server's logs. After an "anonymous leak", it's the first place they'll look.
The only good alternative is to keep quiet, and pray that nobody else finds it and anonymously report it to the press before the logs containing your IP address are rotated and deleted.