[qwertyuiop12]

Report only to companies that accepts publicly vulnerability reports and keep all the records

[Buttons840]

This doesn't answer my question. How can we change the laws to improve the situation? From a national security perspective, hoping individuals do the right thing despite great personal risk won't work well.