The law matters less than the legal team

I'm not a lawyer, and if I was, I'm not your lawyer.

With anti-hacking laws there's a criminal end and a civil end. On the civil end, if the company that you're hacking on gets sufficiently pissed off about what you're doing, and has a sufficient resource base and a legal team available to mount a case against you, they'll probably do that. That's usually what determines whether a civil suit happens or not. The law itself matters, but it's not as predictive as it is on the criminal side.

That's why safe harbor is so important to reinforce for individual security researchers. We don't necessarily have deep pockets or legal teams.

From my conversation with Fede Kirschbaum on XBOW's Offense Taken.