Criminal offense in the US, not in Russia. Company is based in Russia and sells its products online through its website last time I visited it. The US is exerting its sovereignty beyond its borders into Russia. The product was sold to Americans buying from a Russian company, based in Russia which hired Russians who were living and working in Russia. I bet you'll come up with some justification like you did in another thread where you said we should screw with foreign nations and their governments whenever it can in any way make us more prosperous or "safer."
On the other hand, it's conceivable that the DMCA permits a civil suit against an academic report that includes source code or object code.
In other words, it must remain theory. No proof of concept. Most jurors couldn't tell the difference between an algorithm written in pseudo-code and one implemented in a real programming language. Effectively, unless you write the algorithm in a natural language, it is a potential civil offense.
If published research does not include working code--which is a vital part of research--the odds of a successful lawsuit rapidly approach zero.
Any decent code monkey can take a good algorithm and implement it. So once again, no algorithm.
Basically what he's saying is that you can talk about a potential hole in a DRM system, but you cannot in any way publish anything that could actually demonstrate its real existance.