Bug Watch: Ethical hackers expose legal flaws