At what point does computer security research become hacking? What can happen if you violate TOS? Is intent, not the act, more important?