Ho-humm. Care to point where the Hungarian law mandates this? The old BTK was simpler but even the new is pretty clear in that only a very few serious acts are mandatory to report (meaning not reporting is a felony in itself). 145. and 159 § details how military and civil superiors must report the crimes of those under them, obviously does not apply. 191. § makes reporting attempted or committed kidnapping mandatory. 263. § are crimes against the state, treason, spying and shit. 300. § makes it a crime not to report corruption but only for officials. 317. § makes terrorism mandatory to report. 328. § is about violating international sanctions. Finally 404. § makes reporting of certain financial trickery but only for the actual executor of the bankruptcy.
Which one was this one? Or did I miss something? Was he trying to sell stuff to Russia violating the sanctions? Did he make an attempt to overthrow the government? Or what?
and Hungarian law -> this is how they did it
European law about data protection and breaches, not sure if it is in effect yet and not sure if it applies to this exact case:
http://www.lexology.com/library/detail.aspx?g=8185429b-c98d-...
Moreover, it is not only Hungarian but also European law to report incidents involving personally identifiable information leaks and there are authorities that investigate and fine companies failing to comply with the law. Any person (including you) can report such companies to authorities.
But ofc I got your point.
I understand that you are experienced in law, I understand what you wrote. Although, I do not think that it was the right thing to do. And maybe because of the reactions and the scandal, it will change in the future.
Would not have happened anything if we had just ignored this. We did the right thing.
Sorry but how exactly electing a different party is supposed to change anything ? Moving to another country will not help either as most other countries are the same or worse.
> In Hungary, according to the law, this was pretty much illegal.
Besides this has been used for decades by corps to prosecute vulnerability reporters, see Serge Humpich who discovered a huge vulnerabilty in bank cards back in 1997. He reported to european bank card Economic Interest Group (EIG) with the support of a lawyer who said they would not believe him until he proved it practically. So he went an bought metro tickets that he did not use but sent them with every details of the transaction. The EIG then got him arrested, prosecuted and sentenced for bank fraud and falsifying a bank card. The fun part is that this got publicized and it was not long before bad guys found the vulnerability too and started issuing yescards (bank card that say yes to any withdrawal from an ATM) and it cost them many tens of billions of euros over a few years due to fraud and upgrading their security and hardware in a hurry.
Have a look at this list, many of them thought they are not doing anything wrong:
https://en.wikipedia.org/wiki/List_of_computer_criminals
The point is that we live by the law, not how you feel about a certain action. I agree that the law is a bit problematic but regardless we cannot cherrypick which law to follow and which not.