Most of what spy agencies do would be illegal if we didn't make exceptions for spying.

I'm not sure how to interpret your remark. Generally, we want people to obey the law for a number of reasons, like their own safety, safety of others, morality, protecting rights of minorities (or even majorities), the ability to speak out about wrongs or injustices. Generally, we have laws that we hope encourage us to do good things, and discourage us from doing bad things.

Shouldn't spy agencies do good things, and avoid doing bad things? Letting spy agencies not be accountable for bad behavior seems like a policy that won't work out too well, that will lead to contradictions like eating meat, but hating the butcher for killing animals.

That is, if freedom from being spied on is a good policy for US citizens, it seems like it's a good policy for everyone, regardless of citizenship. The opposite policy (no spying on citizens, but spying on everyone else) ends up making the lack of surveillance a temporary privilege, to be revoked by someone if and when the policy becomes inconvenient.

It wasn't a normative statement. Rather, it was intended to point out what you just did: if you want spy agencies to follow the same laws everyone else does, you're effectively arguing that there should be no spy agencies.

The DMCA outlaws bypassing copy protection schemes and access controls. It explicitly _exempts_ (ie, does not make illegal) bypassing copy protection for legal reverse engineering activity, including security research.

Read the DMCA. It's surprisingly readable. It does not outlaw reverse engineering.