I'd think he has the right to keep it. That right also comes with any criminal liability associated with improperly handling or releasing that data along with

I'd think he has the right to keep it. That right also comes with any criminal liability associated with improperly handling or releasing that data along with any civil damages that follow from the same. You'd be foolish to actually want to express this right. However, there is zero chance I'd acquiesce to a third party high end security contractor like Kroll in to "scan my systems." I found that a little bit disturbing for a city to unleash it's world wide third party contractor on an unsuspecting civilian that was trying to help them out of a _legal mess_ they created.