The decision by the Department of Justice announced Tuesday to dismantle ‘hundreds’ of web shells installed using Exchange Server vulnerabilities, mitigating the threat to private servers in bulk, is being hailed as a landmark use of a new authority. But the move also invited concern among some in the cybersecurity community about the lack of any clear standard for when and how government may hack private systems.