Sounds to me like this researcher is going to be brought up on charges. Well deserved charges. We don’t know what he did with this domain before he contacted krebs. He very well could be covering his tracks and creating plausible deniability.
You break the law, you go to jail. Simple as that. They aught to make an example out of him.
Surely everyone already knows what happens if you maliciously create a .gov domain? What would making an example of this security researcher do, other than have a chilling effect on the field as a whole?
You break the law, you go to jail. Simple as that. They aught to make an example out of him.