I just recently saw the SEC secretary say that ico’s are not illegal if they were to be done roughly behind closed doors, so to speak.
Meaning, don’t spam to the world your ico address and be diligent as to who you’re talking to about potential investments.
The SEC secretary wants a fine line distinction between a “private” and “public” raising of money. He’s right to point that all icos (besides filecoin) are trying to be considered as “private” while publicly share their address and don’t discern who sends in funds.
Cryotpkitty is under the current existing Ethereum network. Like how you can still buy bitcoin. ICO are initial coin offerings, so it's an investment before the actual coin is released and on the market.