So, A good Samaritan must know all workings of the malware, including trip wires, actual triggers and threat scales. And, must know if any threats that get rel

So, A good Samaritan must know all workings of the malware, including trip wires, actual triggers and threat scales. And, must know if any threats that get released (not yet in sandbox) as a consequence of his investigations. A good Samaritan must seek and get all necessary approvals using a procedure and checklist. If such procedure, checklist and inventory of authorities to seek approval from does not exist, the good Samaritan should immediately embark upon the task of defining one. Fully realizing that just creation of such listing would require constitutional amendment. A good Samaritan should be able to look away from current mayhem (patient support systems, ambulances, public infrastructure collapsing) while above things are settled first. On an existing command chain, sure, up to a point. US doesn't have any control if someone at Kaspersky had done it or some kid in Asia trying to understand how it works. What you are proposing is going to make people on good side to disengage at the thought of prosecution. You would be shooting your soldiers for not successfully defending you. Worst, you would shoot enemy of your enemy for triggering the common threat. The control that you desire goes against nature. Unless you put every single human being in matrix, you won't have that control.