Q:

How to encourage my ISP to use better security

One day, I was playing around with my router configuration. As the result I was able to view TR-069 configuration. I was able to see that the updates server was using HTTP protocol, instead of HTTPS. This made me worried about my router security. From Defcon 22 ( https://youtu.be/rz0SNEFZ8h0 ) I know that TR-069 should be used together with HTTPS protocol, to minimize risk of attacks.
I have disabled my TR-069 at my router to not be vulnerable.
Today however I received an email from my ISP, asking me to format my router using reset button on back. While the email does not explain why this is needed, I expect this to be because of disabled TR-069. For now I ignored the email, however if my ISP requires me to have TR-069 enabled, I at least want to be sure that such things can not put my security at risk.
My question is how can I encourage my ISP to use better security? 
As a side note I would like to point out that I live in UK, and I would not like to get into any troubles.

A:

Tell your ISP about the issue. It's unlikely to do anything, but you should do that for ethical reasons before you take the next steps.
After they ignored you for a few weeks, report the issue to any technology-oriented news websites which are popular in your location so they can shame them.
Should the websites be uninterested in running the story, or should the ISP not consider it worth their while even after they got publicly shamed, look for a different ISP.

