so, if one only decides to fix a bulnerability that a system has, for that reason alone I can already be considered a criminal?