[stavrianos]

That fourth one is the killer. Regardless of its truth or falsehood, it gives everyone an out because none of the interesting consequences of the first three have to happen.

Perhaps the proper move would have been to surveil the malware without revealing that you know of it. Could prove/falsify #4, or implicate PD conclusively if #1.