0

Ok, I am going to ask this question with an Analogy. A Locksmith is walking in the street and comes across a door. The door seems to be well secured to a normal user and is actually a door to safe deposit vault/ stock exchange etc. The locksmith notices something unusual the Locksmith has an account (but no safe deposit) himself in the bank. Concerned the locksmith waits and see unusual activity like people who don't look like bank employees loitering around the door. He also observes that the security is so bad that it might be deliberate ignorance. Also, the Locksmith is a convicted (Ex CatBurglar) so him observing and reporting this can give the wrong signal to authorities.

Another analogy to this is an ex/reformed "Some Amateur Troll" observed "Some Country X Trolls" on a "Big Network" but can't point fingers and also cannot approach both cause he legally cannot say "Country X Trolls" activities benefit "Big Network" and "Big Network" might be simply naive or maliciously ignoring such activities for their own benefit.

How does he inform stakeholders legally?

| improve this question | |
  • 1
    So basically you noticed someone trying to hack a large network? – Putvi Apr 8 '19 at 19:46
2

Duty of care dilemma when reporting Web vulnerabilities to both Stakeholders and Web Service owner

Does OP have any duty of care to stakeholders or the web server owner? No.

OP is not obligated to inform anyone. OP didn't create the problem and isn't involved in causing it and doesn't owe any special duties to the Stakeholder and Web Service owner. He doesn't even know for sure if there is misconduct.

If OP none the less feels morally compelled to do so (he should remember the maxim that "no good deed goes unpunished" before doing so), he could give an anonymous tip to persons or in places that would create an opportunity to act upon it, although the tip should not in any way make it possible to identify OP.

How does he inform stakeholders legally?

From context it seems that OP is technically sophisticated enough to know how to provide an anonymous tip, but if this is mistaken, those matters could be considered further (perhaps by someone more familiar with the tech and the industry than I am).

The tip should make clear that it is an inoffensive, helpful FYI and not a threat.

So, who does OP provide it to?

The right person might be the email of the right person to handle the issue within the Web Owner's organization (or the best available contact point if that is not clear), and the right place to inform stakeholders might be a forum or discussion board similar to Stack.SE but particular to that platform, or to the contact information of a known and prominent Stakeholder who is likely to and is likely to be able to, take action.

| improve this answer | |
  • That doesn't really address his question. – Putvi Apr 8 '19 at 22:01
  • 1
    @Putvi the first paragraph answers the title, the last paragraph answers the questions in the last paragraph of the OP. The middle paragraph is some prudential advice. He wants to inform the stakeholders, rather than the police and there are good practical reasons for doing so. – ohwilleke Apr 8 '19 at 22:03
  • I get that he does not want to inform police, but this doesn't show a specific way to inform "stakeholders". This whole question is a little vague tbh. – Putvi Apr 8 '19 at 22:05
-3

Even if the person reporting was convicted of something in the past, he still reports crimes to the police. That never changes.

| improve this answer | |
  • Well informing random people isn't one specific scenario, as there isn't just one way to find or contact all the victims. – Putvi Apr 8 '19 at 20:23
  • 2
    There is not, in general a legal obligation to report a possible crime (or even an actual crime). It may be morally right, but it is not legally mandated for a person in no way involved. This answer seems to imply otherwise. – David Siegel Apr 8 '19 at 22:07
  • I don't know how it seems to imply that lol. – Putvi Apr 8 '19 at 22:08
  • @Putvi the title of the post talking about "duty of care" seems to imply that. – ohwilleke Apr 8 '19 at 22:09
  • 1
    Oh you mean duty as in mandatory reporting. I took the car dilemma part to mean how should he report it, not if. – Putvi Apr 8 '19 at 22:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.