I don't know, the act of confessing that it was done in bad faith?
I have kept myself up late at night and in the early hours of the morning hoping that I made the right decisions in trade offs to protect my users, their data, and the company I worked for. I've worked for some companies that treated me pretty shitty. I've experienced racism, gas lighting, overworking, and being underpaid in my career. Never once did it occur to me to turn that hurt and frustration on the company or my users.
This is possibly one of the strongest possible cases I have seen to professionalize software engineering. Holy smokes.
You have an anonymous comment that claims to have caused a data beach of unknown data from an unknown company. No users are even mentioned.
I feel like it's a strange thing to call out as a compelling argument.
I don't think you can even call it that, since he didn't cause the breach. It's hard to even liken it any employee repeatedly and deliberately leaving the door to a store unlocked, which eventually gets robbed. Since I get the impression the stuff he's talking about would have probably been inside some kind of perimeter defense.
IANAL, the best I can make of it from a legal perspective is some kind of negligence, but that's a tort, not a crime. So he may not have to worry so much about the RMCP, but rather losing his car to pay damages to his employer.
I think there's a compelling argument for an ethical violation, but I'm still not seeing a criminal one.
What crime, exactly? I doubt what he did is any kind of crime. Honestly, some PMs would probably do the exact same thing (e.g. focusing on the "customer" by de-prioritizing "tech debt" to work on "higher priority" work).
Edit: not to say it wasn't unethical, but the bar for criminal conduct is not the same.