A report from the inspector general for the Justice Department contends the Federal Bureau of Investigation did not violate any rules when an agent impersonated an Associated Press news editor to catch a bomb threat suspect.

“Judgments agents made about aspects of the planned undercover activity in 2007 to pose as an editor for the AP did not violate the undercover policies,” according to the report [PDF].

It additionally concluded the FBI’s policies in 2007, when the impersonation took place, did not address the tactic of impersonating journalists. Undercover policies provided some guidance for agents but were unclear.

However, the inspector general acknowledged the FBI adopted a new policy in June, which would have prohibited the impersonation that took place seven years ago.

“The Associated Press is deeply disappointed by the Inspector General’s findings, which effectively condone the FBI’s impersonation of an AP journalist in 2007,” AP’s vice president and director of media relations Paul Colford said. “Such action compromises the ability of a free press to gather the news safely and effectively and raises serious constitutional concerns.”

“Once again, AP calls on the government to refrain from any activities involving the impersonation of the news media and we demand to be heard in the development of any policies addressing such conduct.”

In June 2007, the FBI used a software tool called a “computer and Internet Protocol address verifier” or CIPAV. The agency sent a private MySpace message to an account associated with a bomb threat suspect, a 15 year-old student at Timberline High School near Seattle. The message contained a link to a “phony AP story about the bomb threats posted on a fake Seattle Times webpage.”

As described in the inspector general’s report, “During subsequent online communications, the undercover agent sent the individual links to a fake news article and photographs that had the computer program concealed within them.

“The individual activated the computer program,” or malware, “when he clicked on the link to the photographs, thereby revealing his location to the FBI. FBI and local law enforcement agents subsequently arrested the individual, and he confessed to emailing the bomb threats.”

In 2014, Christopher Soghoian, principal technologist for the ACLU’s Speech Privacy and Technology Project, uncovered the shocking detail in a document provided under the Freedom of Information Act to the Electronic Frontier Foundation. The Seattle Times reported on it, and the AP and other media organization were outraged.

AP General Counsel Karen Kaiser maintained, “The FBI both misappropriated the trusted name of the Associated Press and created a situation where our credibility could have been undermined on a large scale.” She added, “It is improper and inconsistent with a free press for government personnel to masquerade as The Associated Press or any other news organization,” and the FBI’s actions “undermined the most fundamental component of a free press—its independence.”

In response to AP criticism, and questions from media, FBI director James Comey insisted the technique was “proper and appropriate under Justice Department and FBI guidelines at the time,” but added, “Today, the use of such an unusual technique would probably require higher level approvals than in 2007, but it would still be lawful and, in a rare case, appropriate.”

When the scandalous decision to impersonate a journalist was defended by the FBI director, the Seattle Times editorial board published an editorial, which featured two key questions: “How often do agents appropriate media company identities?” and “When will they stop?”

The inspector general’s report somewhat answers the latter question. The FBI will not stop impersonating journalists. If it is useful to an undercover operation, they will go through a process, including a new layer of bureaucracy added in response to media outrage, and appropriate names of media organizations to catch suspects.

Unfortunately, for concerned media, the report offers no details on the history of this practice, such as how many times the FBI has impersonated a journalist, editor, or news organization.

The Reporters Committee for Freedom of the Press (RCFP) and AP sued the FBI and Justice Department for documents on rules applicable to FBI agents impersonating journalists. Some documents were turned over, and in April, Hannah Bloch-Wehba of RCFP declared, “The FBI failed to follow its own rules,” according to the obtained documents.

But that statement depends on whether FBI agents impersonating news media is a “sensitive circumstance,” which would have triggered a more extensive process for approval of the tactic. The agents involved in the operation did not see it as “sensitive,” and the inspector general mostly backed up this decision.

According to the inspector general, “The undercover agent who communicated with [the bomb threat suspect] did not use the ‘online identity’ of a person who was a member of the media, nor did he make untrue representations about any third person. Rather, the agent used the identity of a third party – the AP – without that party’s knowledge or consent.” No higher authorization was required.

Except, the inspector general acknowledged that the bomb threat suspect may have believed he was a source of information for a reporter and entitled to “reporter-source” privilege. The report recommended any time a subject may believe he or she is entering a “privileged relationship” it should be treated as a “sensitive circumstance.”

The inspector general noted the First Amendment concerns and how impersonated journalists could “impair news gathering activities.” It even acknowledged the Justice Department’s change in policy, when it comes to subpoenaing or collecting records on journalists, and suggested this new policy put forward in June was an “important improvement.”

What the inspector general did not fully contemplate is the nature of disclosure—how the press and public came to be outraged that the FBI was impersonating journalists.

By sheer serendipity, and perhaps a slip by some personnel involved in processing a FOIA request, AP learned the FBI appropriated its identity seven years ago. The FBI never extended any courtesy and informed AP they had engaged in this act. The FBI planned to keep this tactic secret. When it became public, they could not defend it without agreeing to tinker with policy guidelines slightly.

The fact remains the FBI does not think it is wrong to impersonate journalists, the inspector general is not going to stop them from doing it, and the public still has no idea how many times this tactic has been used and under what specific circumstances.