Ask HN: What are my options after a responsible disclosure went wrong?
1 comments
IANAL but I'd say it is going to depend on your country's digital security laws. Personally I'd be letting them know the story is going to end up in some technical IT rag and their third party vendor runs the risk of being named and shamed for such a simple hack in this day and age.
My child's healthcare provider uses a third-party vendor for its patient portal. While using the portal, I discovered that simply changing the profile ID in my browser's developer tools (Inspect) caused another patient's information to be returned. I documented the issue and reported it to the healthcare provider.
A month later, the provider emailed that the issue had been resolved and shortly after that, terminated my child's services. Their letter alleges I committed "unauthorized access" on four separate dates, including one where the provider asked me to provide proof of the issue, and says law enforcement confirmed my actions constituted criminal activity regardless of intent. I dispute that characterization. No law enforcement agency has contacted me.
I've spoken with two attorneys, but the consensus seems to be that this is a legal gray area, and I haven't gotten much practical guidance.
For those with experience in responsible disclosure or computer access law:
I'm not looking to debate the facts of the case; I'm trying to figure out the best path forward.