Why the leak might be more serious than the threat itself