As the comment says, it is good practice to make a defensive copy to avoid potential malicious updates from outside. http://findbugs.sourceforge.net/bugDescriptions.html#EI_EXPOSE_REP2