The line between security research and espionage seems really thin.