> The trick of course is that the malware can't be traced back to the police

Isn't this even more complicated to prove in the case of private bounty hunters, instead of the police?