The laws about intent and conspiracy have always worked this way. In order to prove intent in the US a lawyer must usually provide two different facts of evidence. One of the facts is usually a plot.

For instance, if you go and tell your friend that you are going to rob a bank and that you have a gun to do it. You haven't broken any law. Now if your friend goes to the police and tells them that you are going to rob a bank, and in the course of investigating your statement the police find a gun. You are now quilty of intent or conspiracy.

SO in this particular instance if you said, I'm going to extort money from XYZ bank by encrypting their data so that they can no longer access it, and then you have the software on your computer which could accomplish this task then you are also guilty of having criminal intent..

In the cases of banks or security researchers. Be careful what you say. It may be really difficult to prove that you were "only kidding" when you make that claim about breaking into something. As long as you don't make a statement about doing something illegal with the tools that you have you are not in violation of any law..