evidence: Similarly, these measures are not intended to target persons engaged in legitimate activities to ensure and promote the security of information systems, such as penetration testing and other methodologies, or to prevent or interfere with legitimate cyber-enabled activities undertaken to further academic research or commercial innovation as part of computer security-oriented conventions, competitions, or similar "good faith" events [...] For more information, see FAQs 205, 206, 231, 232, 934, and 938. [...] You need to discuss this with your state authorities and with OFAC.