Taken from last bread. This is the best argument Ive seen for why it may have been whitehats (recording was not blocked to public on purpose):
It should also be noted that the alleged conversation between the air traffic controller and the suspect was never secured. When I say secured what I'm referring to is switching to an encrypted radio frequency that cannot be scanned by the public. You may be asking yourself why that's significant. The reason that it is significant is because for all intents and purposes, this was a real world terrorist incident, hence the scrambling of the F-15 Iron Eagles. When a situation of that magnitude occurs, operators will switch to a secure network, so as to avoid any interference that could jeopardize the situation. Any and all audio recordings should have been secured immediately, as they would now be direct evidence for the crime that was being perpetrated. In this case those comms were never secure.