No good deed goes unpunished.
Kid should have just sold his hack to the highest bidder and skipped the country. Denounce me as unethical as all you want but his situation would be objectively better if he hadn't cooperated with the authorities.
Kid should have just sold his hack to the highest bidder and skipped the country. Denounce me as unethical as all you want but his situation would be objectively better if he hadn't cooperated with the authorities.
Your second statement roughly mirrors the parent comment in saying that the guy would have been served better by selling the vulnerability, but surely you don't believe that that's the only criterion for determining if something is ethical, right?
Do you have in mind a buyer who would make such a sale ethical? I would imagine intelligence agencies of major European powers, as well as the US and Russia, as the nation-state buyers, plus organized crime as another possible buyer. Among that field of upstanding people, who do you imagine this exploit could be sold to without clearly and knowingly contributing to massively unethical operations? Perhaps the NSA wouldn't be too terrible a result, because they would just use it to watch everyone rather than cause instability and threaten officials, but for that extra potential it seems like organized crime would be the bigger buyers. Or do you excuse everyone so long as they're not the final link in the chain, the one firing the gun?
I hope that I've just written all of this out of a misunderstanding of your comment, because in no world is selling this vulnerability ethical. If Slovenia were a huge liability, likely to start World War III at any time, maybe, but that's just not the case.
It would be ethical to report about vulnerability but without disclosing your name. And if it won't fixed, disclose it at public.
I imagine state actors as the most likely buyers and way worse offenders, than organized crime. In the world, you believe in, it might be unethical to sell to them. In the world, where the state actors are the enemies of the people and the enemies of each other, it might not, but passively not doing anything might be.
Really? If the thing is used for anything important, just sell the intercepted data on darknet :) And it seems this was passive reception of radio traffic - it'd take them a while to find him.
The whole story just illustrates the danger of doing security research in the open. If he tipped them anonymously, he could simply pass the news to the media after a month and they'd have to shut up and fix their shit.
I once refrained from reporting a web vuln for similar reason - I didn't trust the owner to handle this professionally and, unfortunately, I didn't use tor because I attempted the hack just for fun wanting to see how they are protected from that - turns out, they weren't at all.
I don't agree, but I could imagine feeling this way in another universe.
While I'm not down with selling the hack, not interacting with police is always good advice.
It's shown over and over again that official contact with the police rarely has good results, at best has neutral results, and sometimes has VERY bad results.
The path of least resistance is mutely accepting that it's a bad idea to talk to police, or otherwise engage with authorities.
Those who hold so much power over our lives must be held to much higher standards: of responsibility, ethics, and behavior. If you want change, take the path of maximum resistance.