That’s why I mentioned the whistleblower statutes. SARs are not crimes. They are potentially suspicious activity. If there is a crime not being reported after collection of these SARs then blow the whistle. No reason to leak a bunch of them unless you believe the collection of such data to be illegal in the first place (it’s not).

For what it’s worth, the problem is that most folks don’t know what SARs are, when they’re filed, etc. This is basically the equivalent of leaking a bunch of private banking records that banks have to provide to the government, not “leaking hidden crimes that nobody stopped”

not only shouldn't it be illegal, it probably isn't while the NDA might be illegal (and be evidence of conspiracy)