They can, and many do or have done so in the past. Let's not pretend that security incident post-mortems are anything new; they aren't. There's not really even

They can, and many do or have done so in the past. Let's not pretend that security incident post-mortems are anything new; they aren't. There's not really even anything special about this one. I don't really see much point in applauding these guys for doing what's perhaps the minimum we should expect from them in this situation.