By expanding the case against Marcus Hutchins, the Department of Justice has signaled a troubling interpretation of cybersecurity law.