[esafak]

Who compensates them for the risk?

[lucb1e]

What risk? It sounds to me like the worst they could get is a subpoena to produce the identity of the reporter

Besides, it's usually governmental organizations that do this sort of thing

[esafak]

The risk of lawsuits like the ones threatened to be filed against this researcher.

[lucb1e]

They can also sue the pope but I don't think the pope finds that a risk worth considering either when they didn't do any hacking, legal or otherwise. How would an organization get sued for hacking when they didn't do any hacking and are merely passing on a message?

[esafak]

They would call it abetting. It's not as if the site doesn't know what it's disclosing.

[pixl97]

That's why you just sell it on the black market and let it be the intermediary.

[nickorlow]

The free market at work!