Engineer reports data leak to nonprofit, hears from the police

A security engineer and ex-contributor to an open systems non-profit organization recently reported a data leak to the organization.

In return, he first got thanked for his responsible reporting, but later heard from their lawyers and the police.

Apperta Foundation is a UK-based non-profit, supported by NHS England and NHS Digital, that promotes open systems and standards in the digital health and social care space.

GitHub repository exposed passwords, keys, database

This week, a British cloud security engineer Rob Dyke spoke out on how an instance of ethically reporting a data leak landed him in legal trouble.

Earlier this month, Dyke had discovered an exposed GitHub repository exposing passwords, API keys, and sensitive financial records which belonged to Apperta Foundation.

On discovering this GitHub repository which, the engineer says, was public since at least 2019, the engineer privately reported it to Apperta, and got thanked by them.

On March 9th, however, he received legal correspondence from Apperta's lawyers, leading him to hire his own solicitors to represent him.

Furthermore, an email followed yesterday from a Northumbria Police cyber investigator in relation to a report of "Computer Misuse."

In a phone interview with BleepingComputer, Dyke told us that having worked with Apperta in the past [1, 2, 3] and as someone currently working in the IT sector, he's very familiar with both Apperta's established mechanism and the industry practices when it comes to responsibly reporting security vulnerabilities to vendors.

When he came across the data leak, Dyke had immediately reported it to Apperta.

To have a record of what he had reported, however, the researcher encrypted the data he had come across and securely stored it aside for 90 days, as a part of the coordinated disclosure process.

"I knew how I was supposed to report it to them. So I reported it to them, via their established procedure," the engineer told BleepingComputer further adding that he had received a reply from Apperta with the representative thanking him, and stating they'll get the issue sorted.

"And I didn't really think any more about it," Dyke continued.

A little over a week later, a letter arrived from Apperta's lawyers stating that they considered Dyke's actions as "unlawful" and demanded a written undertaking that any data the engineer had come across was deleted. 

This left the engineer surprised especially considering that Apperta team members knew him from his past contributions.

In emails seen by BleepingComputer, Dyke further clarified to Apperta's lawyers that the information he came across was being leaked on GitHub publicly for over two years, rather than proprietary data obtained as a part of unlawful hacking activity.

The details gathered by the engineer as a part of the responsible disclosure was done so from openly accessible public URLs published by Apperta on the internet.

Dyke further issued a written affirmation that he will destroy any copy of the repository obtained from the public web service (GitHub) and provide a certificate of destruction.

Yesterday, another letter arrived from the Northumbria Police station inquiring more details about what the police refers to a report of "Computer Misuse (Act)."

The engineer told BleepingComputer he believes the police investigation is linked to the Apperta incident, given that Northumbria Police oversees the jurisdiction where Apperta's offices are located.

"I don't think this is the way to go about it for an organization that's promoting openness, and, all of the things that go with that; transparency, accountability, and responsibility."

"Since I've found this leak, and helped them out, this is simply not the way to go about it. I gave [them] assurance that the data will be deleted, and it has been deleted," Dyke further explained to BleepingComputer.

UK Computer Misuse Act scares away 80% of infosec professionals

This is not the first time an information security engineer has allegedly stepped into the legal gray area of UK's Computer Misuse Act (CMA).

The Register has repeatedly [1, 2, 3] tracked developments on Computer Misuse Act and why time and time again both British infosec. firms and academics have urged that aspects of the dated law be reformed.

A study conducted by the CyberUp campaign stated that 80% of security professionals were scared of falling foul of Computer Misuse Act during course of their routine professional activities.

The provisions of the UK Computer Misuse Act of 1990 are vast and extensive and may even consider simply coming across a data leak as an "offence."

Even work activities of UK-based threat intelligence providers probing foreign systems may be considered illegal under the Act.

BleepingComputer reached out to Apperta Foundation multiple times and Northumbria Police well in advance for comment, but we have not heard back.