Victorian Transport Department calls cops on 16 year old for reporting bug that exposed customers' personal data

If you see something, say nothing!

I guess the right thing to do is to anonymously publish your findings on the web, along with a note explaining why you are taking such actions, and letting the authoritarians authorities take the heat and the responsibility for the results.