At this point, what about malformed requests from homegrown browsers that trigger catastrophic bugs in the upstream application, does this now constitute a federal crime?
At no point did either party intent to cause harm, but it happened anyway.
Really, I quite like the British framework for this sort of issue: anything can be illegal or legal, it depends on context and motivation.