I think usually the idea is you prosecute the person who steals the information, but if they pass it to another person who publishes, that person can't be prose

I think usually the idea is you prosecute the person who steals the information, but if they pass it to another person who publishes, that person can't be prosecuted. If the same person stole and published I'd expect they could still be prosecuted. But others resharing it, (eg if someone posted a pastebin and others shared) would not.