I've been struggling with a decision for the last week or so. About a week ago, I happened to stumble into an online... let's say area, where people are, amongst other things, openly discussing illegal activity they engage in. I don't mean they're having vague discussions. I mean there are specific, verifiable details. I can even identify a number of the people involved in them by name.
The problem I'm faced with is I don't view the illegal activity in question as "wrong." I'm not saying it is good or should be legal. I just don't care if people engage in it. For the sake of discussion, let's imagine the activity was selling marijauna (it is not). Given the locations and quantities involved, people could be facing significant jail time if I reported them to authorities.
So here's the dilemma. Do I have an obligation to report criminal activity to authorities even if I don't have a problem with the activity itself? Legally, I know I might. On the other hand, people routinely fail to report criminal activities for any number of reasons. And everybody breaks some laws. I don't know how one draws a clear line between speeding/selling a narcotic which makes one okay and the other heinous.
Supposing I don't report what I've discovered to the authorities, what about the area I've stumbled into. It was obviously meant to be secure. Can I walk away without reporting the security vulnerability I discovered which allows anyone to enter, even by mistake? If I do, am I not (partially) responsible for any future cases of someone stumbling in like I did? But if I report the problem, aren't I actively assisting criminals and helping them get away with breaking the law?
As a final question, the problem with the security for this area which I accidentally exploited gives me administrative control over everything which goes on in it. I've also confirmed there are no external backups. If I don't report what I've discovered to the authorities or the people engaged in criminal activity, what should I do with that control? Do I ignore it and never go back? Do I monitor the discussions out of some sort of voyeuristic delight and/or attempt to ensure no criminal activities of a more serious nature get discussed? Do I shut down the server and destroy all the evidence? What is the "right" thing to do here?