This is more or less a continuation of my previous question: As a student, how do I safely and responsibly disclose a serious security issue in a school environment?
More than four months on after I sent my anonymous letter outlining this security issue, I checked carefully if the vulnerability I reported still existed, and it still does in its entirety. A few unrelated IT changes were made, but these have been mainly directed toward staff (such as introducing BitLocker).
Between the time that I reported it and now, I heard from a close friend (who came from a different school in the same district as me) who had reported a different security issue and who had tried to report it to his computer science teacher, who in turn reported it to the IT department. Rather than respecting the student's anonymity, however, the IT head threatened the teacher with his job (it's not known how he would carry out this threat) if he did not divulge the identity of the student who found the security exploit, and was also threatening the student with disciplinary action or arrest. Regardless of the accuracy of the story, I felt that I did the right thing reporting this via an anonymously and independently written letter.
However, the problem has not been fixed at all. The letter was sent to two different departments in order to ensure that the problem was heard loud and clear and that a plan would be made to resolve it. But none of this happened. In fact, it was as if one person read the letter and convinced the other to throw it away.
The exploit remains dangerous, and at this point I am almost certain that I am not the only one who know about it.
I could send another anonymous letter, further explaining the implications of leaving this exploit in the open. But it would be difficult to do anything else as it would be threatening them to take action "or else." I would turn into a gray(er) hat.
I cannot stress enough the importance of resolving this security issue before something big happens. But I cannot threaten them into doing anything, for that would imply my willingness to do wrongdoing. What are my options?