civil-law
Am I required/permitted to disclose a security risk at a company I do not work for?
<p>Scenario: I shop at a local retail store. While I am there, I notice that store staff have printed out and placed a long list of cleartext credentials for major internal and external business systems, in plain view of customers.</p>

<p>Question 1:
If I take a photo of this list, redact the business name/brand, all passwords and any personally identifiable usernames (or usernames that identify the business), am I opening myself upto a lawsuit for posting this on social media to use as an example of poor security practices?</p>

<p>The only thing identifiable from this post would be the type of store and the city that the store resides in (franchise).
Consider that although I have redacted to the best of my ability, someone may read the post and decide to hunt around the area for a store that matches the photos, then find the list and act on it with malicious intent. </p>

<p>Question 2:
If I do post this list on social media with the aforementioned items redacted, am I legally required to notify the business first in order to give them a chance to take the list down? </p>

<p>For the most part, I think you'd be OK.</p>

<p>To start, try to think of the possible claims that might be implicated by this behavior. I come up with the following to start:</p>

<ul>
<li>Theft/conversion;</li>
<li>invasion of privacy;</li>
<li>negligent infliction of emotional distress; and</li>
<li>negligent interference with contractual relations.</li>
</ul>

<p>I think there are reasonable arguments in favor of liability under any of these theories. If you're also a competitor, I think you might have some exposure through competition law. </p>

<p>At the same time, I think you'd have strong protection under the First Amendment. If we can agree that the risk of a data breach is a matter of public concern -- and probably we can -- it's hard to imagine that you'd be held liable. </p>

<p>For me, the outstanding question is whether taking the picture could open you up to liability, before you've published. The fact that it's out in the open suggests to me that you're in the clear, and I think you'd also have a strong argument that taking the picture is First Amendment-protected newsgathering. But I can also imagine there being some provision in the rapidly growing field of computer-security law that might address this in a way that does not run afoul of the First Amendment. I just don't know enough about that area to lock in an answer.</p>
