Duty of care dilemma when reporting Web vulnerabilities to both Stakeholders and Web Service owner

Question

Ok, I am going to ask this question with an Analogy. A Locksmith is walking in the street and comes across a door. The door seems to be well secured to a normal user and is actually a door to safe deposit vault/ stock exchange etc. The locksmith notices something unusual the Locksmith has an account (but no safe deposit) himself in the bank. Concerned the locksmith waits and see unusual activity like people who don't look like bank employees loitering around the door. He also observes that the security is so bad that it might be deliberate ignorance. Also, the Locksmith is a convicted (Ex CatBurglar) so him observing and reporting this can give the wrong signal to authorities.

Another analogy to this is an ex/reformed "Some Amateur Troll" observed "Some Country X Trolls" on a "Big Network" but can't point fingers and also cannot approach both cause he legally cannot say "Country X Trolls" activities benefit "Big Network" and "Big Network" might be simply naive or maliciously ignoring such activities for their own benefit.

How does he inform stakeholders legally?

Answer 1

Duty of care dilemma when reporting Web vulnerabilities to both Stakeholders and Web Service owner

Does OP have any duty of care to stakeholders or the web server owner? No.

OP is not obligated to inform anyone. OP didn't create the problem and isn't involved in causing it and doesn't owe any special duties to the Stakeholder and Web Service owner. He doesn't even know for sure if there is misconduct.

If OP none the less feels morally compelled to do so (he should remember the maxim that "no good deed goes unpunished" before doing so), he could give an anonymous tip to persons or in places that would create an opportunity to act upon it, although the tip should not in any way make it possible to identify OP.

How does he inform stakeholders legally?

From context it seems that OP is technically sophisticated enough to know how to provide an anonymous tip, but if this is mistaken, those matters could be considered further (perhaps by someone more familiar with the tech and the industry than I am).

The tip should make clear that it is an inoffensive, helpful FYI and not a threat.

So, who does OP provide it to?

The right person might be the email of the right person to handle the issue within the Web Owner's organization (or the best available contact point if that is not clear), and the right place to inform stakeholders might be a forum or discussion board similar to Stack.SE but particular to that platform, or to the contact information of a known and prominent Stakeholder who is likely to and is likely to be able to, take action.

Answer 2

Even if the person reporting was convicted of something in the past, he still reports crimes to the police. That never changes.