Only if the buyer intended to publish the report, in which case it would be the protected intellectual property I mentioned. But if the report were leaked before the private-eye was able to sell it, there is nothing he could do legally to prevent the potential buyer from acting on that information (which is usually why people hire detectives). In particular, the FBI would legally be able to investigate and prosecute people using HBGary's info without paying HBGary. Professional courtesy and/or conflicts of interest might prompt them to pay for it anyway, of course.

What about chain of evidence? Who's to say that the hacker didn't change details of the report between downloading it and publishing it? "This is a report from a security expert" sounds quite a bit better in court than "This is a report that another hacker claims is an unaltered copy he nicked from a security expert".

I was assuming there would be some sort of copyright issues with the information. I think that HBGray owns copyright on the report itself since they likely have some sort of analysis in addition to the raw information organized in an understandable fashion, though I guess there might not be any 'fruit of the poisoned tree'-type issues with the FBI using that information in their investigation.