tw47ddfdf1a705

Publicly releasing a vulnerability is not a crime, even if FB would prefer I didn't.

Yes, and that shouldn't be a crime.

Now a more relevant example:

I discovered a security vulnerability in FB.

1. Publish the vulnerability publicly (legal)

2. Sell the vulnerability to exploiters (illegal)

3. Accept FB's bug bounty reward (legal)

4. Attempt to negotiate a different amount with FB, falling back to #1 (illegal, blackmail)

5. Attempt to negotiate a different amount with FB, falling back to #2 (illegal, extortion)

6. Attempt to negotiate a different amount with FB, falling back to #3 (legal)

I assert that treating #4 as a crime is to use the police powers of the state to protect FB's wallet.

As you've described it, blackmail shouldn't be a crime when revealing the information would be otherwise legal.