29

Note: I created a new account for this question because asking it on my regular account could probably lead to identification of the person it's about.

On one of the many other StackExchange sites, there is someone who I suspect is gaming the system by upvoting his own posts using two different accounts, positively commenting on his own posts using the two different accounts, using a second account to negatively comment on answers that compete with his answer on the first account, etc. I have already reported these suspicions, that's not what the question is about, this is just context (he/they still is/are active though).

Now, because of my suspicions, I performed a google search on the two different account names + a common location for them. This led me to what appears to be a personal website of at least one of the accounts. However, among the google results already there were some strange files on this personal website, which are highly likely not intended to be publicly accessible. Investigating further showed many more files that are publicly available on this personal website. I'm talking about things like:

  • A signed contract for a house in pdf format
  • Archives containing a bunch of source code (the person in question is a programmer), including source files with copyright notices of a company he works at / has worked at.
  • Contact details, birthdays etc. of family, friends, other kinds of acquaintances
  • A .bash.history file, which contains a long history of commands he has entered into his Linux-based computer. This file includes various raw-text usernames and passwords which he entered himself, links to porn sites he has been visiting/downloading from, etc.
  • Various references to the name also used by the second account which I suspect he's abusing on StackExchange, and one explicit mention of using a second account (plus a link to something he's probably using to avoid detection by making it look like the two accounts are operating from different IP addresses).

My Question: Even though I don't particularly like the person due to the behaviour I have perceived, I do feel like I should somehow inform him that all this stuff is publicly available. He'd probably want to know and do something about it.

I don't know what the best way to go about that would be though. I could probably create an anonymous email account to send an email from. However, I haven't been able to find a place where he clearly publishes his email address (I did find various different email addresses in the files which I'm probably not supposed to have had access to though). I'd probably also have to explain how I managed to stumble into this stuff in the first place, but then he's likely going to be able to identify who I am; before finding these files I did already confront him in a comment from my main account that I've noticed his behaviour and don't think it's acceptable.

At the same time, if I'm already contacting him somehow anyway, it would also be nice to ask him to stop his cheating behaviour. I certainly don't want to come across as trying to blackmail him or anything; I have not and will not share his files with anyone else, but I still think he should be made aware that his behaviour on the site is not acceptable. Again, this is going to mean that he can likely identify my though.

Sherlock
  • 309
  • 3
  • 7
  • 4
    I'm voting to close this question as off-topic because this question seems to be more about the technical aspects of contacting someone rather than an interpersonal skill. – sphennings Jul 27 '18 at 16:36
  • 3
    @sphennings - The OP lists a few ways they *could* initiate the contact, so I think the question is more about "should they" contact them, rather than "how". – Kevin Fegan Jul 27 '18 at 17:36
  • 3
    @KevinFegan Questions asking "what should I do?" or "Should I do x?" are off topic. – sphennings Jul 27 '18 at 18:15

2 Answers2

33

I do feel like I should somehow inform him that all this stuff is publicly available.

I would do what someone did to me once (after breaking into a server I was renting and that had been badly protected by the admin): inform.

The guy who stepped in left at the root level a *.txt note saying that he had found a security breach. He touched nothing else. Thanks. Fixed.

I would behave like the White Hat Hacker:

I just found that [ this / this / this ] and this [ data / img / txt ] is accessible through a simple Google search (maybe include just 1 link, to a minor data sheet, in case you hit the wrong guy, it's up to you to decide whether or not you give a link). Hope this help. Signed: White-Hat Sherlock.

All this from a junk email, created, used and dumped as soon as you're done. You've been a fair and nice guy, nothing else matters, nothing else needed.

The second part, about cheating, isn't really of your business though. SO has policies, professional people performing the job, let them handle it. If you think he is tricking the system, inform them and that's it. They'll take care of it.

I'm splitting your OP into two separate issues, as they should not require, IMO, the same treatment.

The security breach and the way you could handle it is nice. Forget about the rest (possibly 2 accounts), you did what you thought you had to. Let it go...

From comments - clarification: As far as my research and understanding were correct, the Computer Misuse Act (UK - 1990), the Comprehensive Crime Control Act (USA - 1984) and the Computer Fraud and Abuse Act (CFAA) (USA - 1986), and lots of others laws across the world (in many languages), until very recently, most say that you may not break into any computer, system, and/or access any data without authorization. It's illegal. It makes the unauthorised access to computer material an offence. So, what the hacker did to me was illegal, for sure, I know it, we/you all know it.

Whether their goal was nice or not, it's illegal. I just kept in mind the core of the action : inform me. They told me, so we could fix it. Without that information, anyone, less well-intentioned, could have done a lot of bad things on our server. I can only thank them for sharing that information. And recommend that you too share, with the owner, any security issue, any part of sensitive data you find exposed on the internet, so that the owner can fix the problem and protect their data.

I used this example, that happened to me, to illustrate the need to inform, not to support it, or discuss its il-legality. And I'm not telling more than: be nice, send an email to share what you've found. Don't let them be exposed.

OldPadawan
  • 21,173
  • 8
  • 66
  • 100
  • 1
    Comments are not for extended discussion; this conversation has been [moved to chat](https://chat.stackexchange.com/rooms/80955/discussion-on-answer-by-oldpadawan-how-to-inform-someone-that-you-stumbled-upon). Once you've all figured out the legalities of this answer in the chatroom, I'd like to encourage OldPadawan to update their answer with the conclusion of whether or not leaving a file at root level is illegal in (many) jurisdictions, so that future SE users stumbling upon this question and answer know whether or not this approach is dangerous. – Tinkeringbell Jul 31 '18 at 21:43
10

As you already stated, both topics are essentially unrelated:

  • You found very personal information publicly availyble on the internet
  • You suspect someone of cheating by using multiple accounts on Stack Exchange

Even though one (cheating suspicion) lead to the second (found private information), they should be treated completely independantly.

If you wish, contact the person on Stack to discuss their behavior, but don't mention your finding any related website.

If you wish, create an anonymous mail account and report the private data you found and where you found them. You don't have to explain how you found it. Address the mail to every mail address you found in this context, chances are that at least some of them are still active. Hell, you could write an actual analog letter and send it to his address...

By saying something like

Hey, I found some really private data of you. And by the way, I really dislike your cheating behavior on Stack Exchange.

you already blackmail or coerce him. You cannot link both topics without excerting pressure on him.

Elmy
  • 6,037
  • 1
  • 13
  • 36