Every Christopher Soghoian production follows a similar pattern, a series of orchestrated events that lead to the public shaming of a large entity—Google, Facebook, the federal government—over transgressions that the 30-year-old technologist sees as unacceptable violations of privacy. Sometimes he discovers these security flaws by accident, other times because someone has pissed him off, but mostly because he’s parked at his computer all day looking for security flaws.

When...