Notwithstanding the right and wrong of this case, if Patrick Webster had done all his investigation anonymously, e.g. through Tor, and expressed his findings to

Notwithstanding the right and wrong of this case, if Patrick Webster had done all his investigation anonymously, e.g. through Tor, and expressed his findings to First State Super in a way that does not imply that he actually downloaded anything, I wonder whether it would have put him in a better position. Even without investigating anonymously, if he had just described the security vulnerability without saying what he actually did, would he be legally vulnerable? I find it ironic that in helping this company with their IT vulnerability, he possibly took on himself a legal vulnerability.