The source could face criminal charges?
Yes, that could be sticky. But what whistleblower has ever been convicted? Seriously.
For an honorable person, it would be a difficult decision to choose between violating privacy laws and allowing Kerry to become president.
I'm thinking if it were me, I would argue that Kerry has given implicit permission by stating that all his record are available on his website. I don't think anyone could successfully prosecute a whistleblower.