It doesn't achieve much, it increases the risk of revealing methods and sources. It also puts US cyber security personnel at greater risk, some of whom have spoken out against the practice.