Heck, even just perfectly comfortable whitehats will just get fed up with overly onerous reporting requirements and disclose publicly (like here).