This one sounds bad, but the problem with the Howey test is that it's overly broad. Anything from presales in a Kickstarter to ICANN selling those new domain names (like .attorney) to selling tickets to a yet-to-be-arranged event could all be considered a security under the Howey test. It's just too broad and nobody knows where the SEC will draw the line. It would be good for everyone if the SEC would simply explain on what would make a ICO legit, because currently their guidance is still too unclear. It's like they want the ability to selectively prosecute anyone, not caring that the regulatory uncertainty is keeping legitimate, risk-adverse teams away, which doesn't help.