I was in a situation about 10 years ago where I wanted to report investor fraud to the SEC. My legal counsel told me I had no protections from being sued. My logic was that a contract (e.g. an employment contract) could not hold me liable for damages caused by reporting a crime. I was told my logic was wrong and that there are few protections. There have been various whistle blower laws for reporting specific crimes. Some of these have been repealed or allowed to lapse.
I think an honest, rational person would contact the FBI in private and seek their counsel on how to proceed.
I suppose I'm thinking of it more along the lines of, say, the person in the next cubicle/department over who knows about such software and wonders what to do about it.
Contacting the FBI and asking the professionals what to do is the most obviously correct path. It's just a matter of curiosity that I wonder what they would say, and whether the advice would work.
Also, you could view Cuckoo's Egg (Cliff Stoll) as a cautionary tale, as he had significant difficulty persuading the FBI that there were foreign spies trying to break in to sensitive sites.
I don't mean "how" in terms of "how do I know the right thing to do", more a question of what, exactly, is the best way to do the ethical thing without getting burned.
Is it better to take the hush money and pretend to be satisfied, then whistle-blow to the FBI once your corrupt boss thinks you're happy? What kind of evidence would you need in order to convince an FBI agent, in a phone conversation, that you are calling in a real crime and not just a prank? If your law-enforcement contact asks you to wear a wire to work and have a leading conversation with your boss, should you do it? What kind of corporate espionage do you perform to make sure a corrupt business does not shred or cover up evidence?
Maybe I've been seeing too many spy movies recently, but I find myself fascinated by questions like that.
There's lots of hacker literature about what to do when you're an employee in the middle of an unsuccessful company, and some about what to do when you are attempting to catch a cracker or other computer saboteur on your network, but I don't think I've ever seen a story or essay on the subject of what to do when your company is not merely clueless but literally criminal.