Which part of that long list of things specifically rules out possession of nmap, a tool used by sysadmins all over the world to help ensure that their own systems are more secure, by ensuring that only specific ports are open for communication?
Mapping a network is not an activity exclusive to criminals.
Though, this particular interpretation does make Google Chrome illegal; it has dev tools that can be used for manually sending HTTPS POST requests with forged headers. (It also has XMLHttpRequest, which can be instructed to do what nmap does with relative ease.)
Mapping a network is not an activity exclusive to criminals.