[enneff]

It is likely that they were able to compromise the bad guys' systems and steal the private keys, which in itself is against the law.

[obitoo]

Technically yes, but in practice only if the bad guys file charges and/or assist the authorities with evidence, ie their machines.