RE: when is hacking legal?

You see, if 'the authorities' started seeking prison sentences for reporters and researchers checking up on their security, then it would dissuade them from carrying out these investigations in future.

It wouldn't make the problem go away. All it would mean is that we, the public supposedly protected by these agencies, wouldn't be aware of their failure.

Those out there looking to find such holes for malicious reasons are unlikely to be deterred by the threat of trial, because, presumably, they see themselves in conflict with said agencies already.

Hiding the problem is not a solution. Security through obscurity doesn't work.