He would need to ensure that:
1. Everything is legal, any infraction could put many, many others at risk.
2. He speaks to precisely no one about it. He should be up front and honest with James about it now, but once that's over he never mentions it again.
3. He needs to be 100% with the infosec guide and protect himself big time from the possibility of doxxing.