The security researcher who notified the media of the breach will be free from the city's lawsuit, but not without a caveat.