Hacker should have asked for immunity prior to disclosing criminal activity.