[lucb1e]

What risk? It sounds to me like the worst they could get is a subpoena to produce the identity of the reporter

Besides, it's usually governmental organizations that do this sort of thing

[esafak]

The risk of lawsuits like the ones threatened to be filed against this researcher.

[lucb1e]

They can also sue the pope but I don't think the pope finds that a risk worth considering either when they didn't do any hacking, legal or otherwise. How would an organization get sued for hacking when they didn't do any hacking and are merely passing on a message?