I think this needs to go even further than just disclosing the algorithm and code. The companies and prosecutors should be required to fund independent audits and bug bounty programs. Otherwise, it would be very difficult for resource strapped defendants to do anything with it.