Criminalising hacking tools