Finding out software errors and security problems on a web site may become a problem: if not only for the site maintainer but also for the person who exposes the flaw. The CSI (not Crime Scene Investigation, but the Computer Security Institute investigates how actual laws increase the danger of getting sued by site owners when somebody detects a vulnerability and talks about that. In fact, there are security researchers who don't inform the site maintainer for fear of prosecution. In a very true statement CSI declares that laws prohibiting security tests will only hamper serious security researchers and not the black hats. CSI's next objectives include exploration of disclosure policy guidelines and mirrored-site guidelines for Web site owners as well as creating a list of research methods for lawmakers' understanding. (Source)

Compared to Germany's planned tightening of security laws, where sheer usage of hacker tools will be punished, this seems to be still a comfortable situation to me.