I think the difference lies in finding the security hole and testing the security hole. In most of the cases that the hacker is persecuted, the hacker has teste

I think the difference lies in finding the security hole and testing the security hole. In most of the cases that the hacker is persecuted, the hacker has tested the hole, i.e. downloaded data illegally. If the hacker simply notified the people responsible before retrieving any data, I don't think that the hacker would be persecuted.