I understand that the answer to questions like this depend on country, but I'd like to get an idea what the usual approach to cases like this are.
Heres the case:
I found a security hole in one of the governments services.
The flaw makes it possible for anyone to download documents that would normally require authorization from the affected service.
I did some tests and made a script that downloads a bunch of stuff from there to test what kind of security issue it actually was.
I have absolutely no intention to use this data for illegal purposes.
I also let them know about it and it should get fixed soon.
Now the questions are:
Is the cursive part illegal?
Would it be illegal for me to store the data and not delete it?
Would it be illegal to publish the data? (I assume yes)
If the cursive part is illegal, how can anyone find and let service provider know about security issue as telling about it reveals that you've used the hole to do something (in this case just to confirm that it exists)?