A teenager in Australia who thought he was doing a good deed by reporting a security vulnerability in a government web site that allowed attackers to steal the sensitive information of public transit riders was reported to the police.