[mdpopescu]

That doesn't actually help; you need to think more like a prosecutor. By investigating the vulnerability they have, in fact, committed a crime - see for example http://blog.erratasec.com/2013/09/how-weevs-prosecutors-are-...