Originally posted on VentureBeat:
- Find a bug that could reveal the personal information of 250,000 students
- Report it to the proper authorities at his school, Dawson College in Montreal, Canada
- Get threatened with jail, and get expelled from college
Twenty-year-old Ahmed Al-Khabaz found a flaw in the college-management Omnivox software that most colleges in Quebec use, according to Canada’s National Post. He reported it to the college’s director of IT, who congratulated him and thanked him.
But two days later, when Al-Khabaz decided to double-check whether a fix was in place, he was surprised by a phone call from Edouard Taza, the president of Skytech, the company that makes Omnivox. Al-Khabaz say that Taza accused him of implementing a “cyber-attack,” threatened him with jail, and forced him to sign a nondisclosure agreement.