Healthy hackers - why are they being banned?

There's a heated debate going on again in government: should we allow "white hat" hackers to operate legally, or leave them in a semi-legal gray zone? "White hat" hackers research vulnerabilities in computer systems so they can be fixed - helping us all improve our security. So why aren't they allowed to operate? And who came up with the idea to prosecute them?