In practice the line between bug bounties and extortion can often be a bit blurry, as well as the line between proving an exploit exists and actually exploiting

In practice the line between bug bounties and extortion can often be a bit blurry, as well as the line between proving an exploit exists and actually exploiting it. I think you’d need a lot more information to draw a reasonable conclusion. That said the prosecutors arguments that $100,000 is so much that it implies criminality, and that NDAs are non-standard (or that they also imply criminality) is complete and utter BS, and instantly makes me incredibly skeptical of the theories they’re operating on.