Engineer reports data leak to nonprofit, hears from the police

The article is a little disingenuous suggesting that the researcher was contacted by lawyers and police for reporting exposed keys. He did report the keys and that was great. BUT...

"To have a record of what he had reported, however, the researcher encrypted the data he had come across and securely stored it aside for 90 days, as a part of the coordinated disclosure process."

That seems to be a slight more problematic thing. If this copy was only cloning a public repo then fine, but if it was using exposed keys in any way to obtain data outside the repo then that would likely be a crime.

Link points to comments, confusing. Please remove anchor.