Over at Security.StackExchange, a discussion broke out over the use of the term "extortion" in a situation where an anonymous security professional sent an email to a business to say that they found a vulnerability in the business' website, but the security professional asked for money upfront before they would discuss any details.

The rest of the context of the email suggests that it is likely a scam (they likely have nothing of value to offer), but I want to put that aside. The actor could or could not have an actual vulnerability to discuss.

Does the situation satisfy the general legal understandings of "extortion"? I see that [New York State law](https://codes.findlaw.com/ny/penal-law/pen-sect-155-05.html) and this discussion about extortion in the [Doha Declaration](https://www.unodc.org/e4j/en/organized-crime/module-4/key-issues/extortion.html) suggests that it could be, but it might not fit perfectly.

There is an implied threat of future harm to the site or business, not by the actor themselves necessarily, that a specific, potentially existential problem exists that anyone could take advantage of. And because all security vulnerabilities are exploited by people, whether by malicious intent, accident, or mistake, then extortion laws that say that the loss/damage could be caused by another, appear to be relevant here. Protection racket discussions seem to also be relevant. 

We could reframe the situation to something non-technical:

PersonA calls PersonB, who is on vacation, and says, "I know you are away from home. There is something wrong with your house. Pay me money and I will tell you what is wrong."

Ethics and morality aside, does the situation cross over into a general legal understanding of extortion? 

This has an impact on how security professionals contact people with whom they have no pre-existing relationship with, to discuss the vulnerabilities they find, while hoping to offer commercial services.