I think FinCEN's position here makes sense. SARs are supposed to be filed broadly and freely, without liability to the filer, in order to allow regulators to build and understand patterns of behavior. They're "suspicious activity", not "unambiguously bad activity". So from FinCEN's perspective, this is like a leak of confidental police reports - filing reports doesn’t make someone bad, and nobody's going to make the reports if law enforcement doesn't go to bat for the confidentiality!