I think it’s reasonable to require them to share details, but source code is a copyright issue and shouldn’t be given up. I’m guessing the source has a lot more than just the one attack.

But yeah, I’m also surprised they’re not obligated to reveal the names of anyone involved in planning or ordering the attack. Surely that could be subpoenad.