Security researchers must navigate a minefield of U.S. laws and statutes, such as the Computer Fraud and Abuse Act.