In any case, responsible disclosure, while a valuable ethical
standard, is not enshrined in federal statutes, and should not trump
First Amendment rights. Such rights aren't absolute; if the students
were to incite others to commit crimes, they could face civil and
criminal penalties. But if expression can lead to penalties after the
fact, that is one more reason not to block it in advance.