They can work together already on everything pertinent to an attack. Nothing stops me from publishing/sharing a log file from a machine that was DDoS'd with IP

They can work together already on everything pertinent to an attack. Nothing stops me from publishing/sharing a log file from a machine that was DDoS'd with IP addresses, etc. Nothing stops me from sharing any evidence of an actual attack of some kind. All this really does is enable them to act as informers on their customers without liability.