Yes, I suppose that's one of the questions: many jurisdictions tend to define their computer crime laws in terms of _unauthorised access_ to computer systems.

Yes, I suppose that's one of the questions: many jurisdictions tend to define their computer crime laws in terms of _unauthorised access_ to computer systems. But in this case that may not be necessary. That's also where the idea of factorization-as-a-service with an auction platform could be useful. I.e. you get a number and you don't ask any questions, which in my complete legal ignorance gives you some degree of plausible deniability.