[wkandek]

I do not believe the FBI can legally report the vulnerability. They did not find it, they do not "own" it. They have used a service to get to the phone's data. Even if they reverse engineered the exploit used, it would be a breach of contract to disclose the vulnerability.

[chc]

I'm not sure what "ownership" is supposed to mean in this context. Legally speaking, how does one "own" a security vulnerability?