...
Returning references that refer to private data to untrusted code can be more pernicious than returning the references to trusted code. If a class defines a clone() method that trusted code can use to pass defensive copies of the instance to untrusted code (OBJ10-J. Provide mutable classes with a clone method copy functionality to allow passing instances to untrusted code safely), the implementing class may violate this guideline. However, the burden is now transferred to the trusted code as it is expected to reliably call the clone() method before operating on the instance or passing it to untrusted code.
...
If the hash table contained references to mutable data such as a series of Date objects, every one of those objects must be copied by using a copy constructor or method. For further details, refer to FIO00-J. Defensively copy mutable inputs and mutable internal components and OBJ10-J. Provide mutable classes with a clone method copy functionality to allow passing instances to untrusted code safely. Note that the keys of a hash table need not be deep copied; shallow copying of the references suffices because a hash table's contract dictates that it cannot hold duplicate keys.
...
EX2: If the performance of the clone() method is within reasonable bounds and the class clearly documents its use, this guideline may be violated. (OBJ10-J. Provide mutable classes with a clone method copy functionality to allow passing instances to untrusted code safely)
...
OBJ10-J. Provide mutable classes with a clone method copy functionality to allow passing instances to untrusted code safely 08. Object Orientation (OBJ) OBJ12-J. Use checked collections against external code