In reference to this Network Computing Report article titled "'Operation Shady Rat' Perpetrated Five Years Of Long-Term Attacks On Government, Enterprises"
The Cliff's Notes to the article is thus: it has been discovered that many countries and large corporations have been the target of long-term, concerted attacks. This information has been discovered through a long term research effort done by McAfee.
A quote from the article intrigued me (emphasis mine):
In a probe dubbed Operation Shady RAT (for Remote Access Tool), researchers gained access to one of the attackers’ command and control (C & C) servers and obtained detailed insight into the victims, the information stolen, and the methods used.
In one of McAfee's statements about the operation, they merely state:
McAfee has gained access to one specific Command & Control server used by the intruders.
But the don't say how they gained access. Maybe it was after a legal seizure of hardware.
How would researchers gain control of an attacker's systems and not themselves have broken the law? Must they attain some kind of "warrant" or legal blessings on this kind of thing? Is it ever acceptable to penetrate an attacker's systems in the course of researching their behavior?