Is this legal? Seems pretty arbitrary. Its not like usa forbids selling pentesting services to foreigners.