Security researchers say they have been threatened with indictment for their work investigating internet vulnerabilities. By Tom Brewster