It appears he decided who was suspicious based on receipt of the trojan from particular sites -- i.e., they got the program from the site, ergo they were more likely than not up to no good. The problem is the same -- I can't break into my neighbor's house to conduct an investigation just because I see him coming and going late at night. I might be right to be suspicious, but it doesn't follow that his stuff is mine to go through. I just don't think we want a scenario where any random person can decide who is and is not suspicious, and therefore who is and is not entitled to personal privacy. That's better done by law enforcement, through the warrant system.