Is it in the public interest?
In the UK the Police would look at it like this:
1) Was the law broken?
2) Is it in the public interest to arrest?
Answer: Possibly, but unlikely.
3) Is it in the public interest to prosecute?
Reason: The guy
a) found a large hole in the voting system
b) told the right people about it
c) helped seal that hole
d) gave further advice with regard to other internet related threats
e) does not appear to be motivated by malice or self gain
Also, an arrest and prosecution may discourage other whistle blowers in the future and in this age we absolutely need people to do the right thing and report such security issues. Otherwise the first that we know about is someone splashing our data across the 'net, black mailing people or even suborning the voting system.
One point of criticism that some folk have (rightly) made is that he should have stopped at the point that he discovered and managed to use the exploit. Perhaps take a few screen shots of the login (not any data). But that requires a verbal warning at most - at least for the first offence.
Anyhoo, we'll see how the Lee County cops / prosecutors deal with this as they might just tell him not to do it again (a caution). I.e. sensible heads may still prevail.