Not so easy to do. As usual, there is a risk that such legislation will be abused to let people who are trying to break in to a system for malicious reasons, claim later it was research. A decent law would require researchers to register with police/whatever before they start researching. Which then excludes researching government/police systems (because they would know up front). etc. Not so easy!