united-states software
How can it be legal to buy and sell zero-day exploits in the US?
<p>There are companies like Zerodium (Wikipedia: <a href="https://en.wikipedia.org/wiki/Zerodium" rel="nofollow noreferrer">https://en.wikipedia.org/wiki/Zerodium</a>) that buy "functional exploits" and sell them to "corporate and government clients". These are zero-day vulnerabilities, that is, vulnerabilities that are unknown to the developer of the software. Ethical hackers and professional security researchers typically report these vulnerabilities to the developer, so that they can be fixed. But companies like Zerodium buy these exploits and resell them to somebody else, we don't know who exactly. These people who buy the exploits from Zerodium are not going to use them legally, because as far as I know there is no reasonable way to use a zero-day exploit legally, other than reporting it to the developer (which they are not doing). Apparently the government is also buying the exploits from them, but that doesn't make it legal anyway.</p>

<p>Somebody might think that this is more or less like buying and selling guns, which is legal in the US. However, it's not really like that. First of all, guns can be used for several legitimate purposes, from fun to self-defense, while zero-days exploits cannot reasonably have such purposes IMO. And then, we don't really know who companies like Zerodium are selling the exploits to.</p>

<p>So how can all this be legal? Are there any specific laws in this field that allow it? Or are there any laws that would define this as illegal, or allow somebody to sue such companies in any way?</p>

<p>Note that what is being bought or sold here is actually <strong>information</strong> about the exploit. Attempting to criminally penalize the transmission of information in the US often runs into First Amendment issues. </p>

<p>If a person has good reason to know that information is going to be used to commit a crime, or is likely to be so used, and there is no plausible legitimate use for the information, that person might be charged with complicity or conspiracy for distributing the information.  But where there are legitimate uses, that is much less likely. Here the information could be used to defend against the exploit, or to identify and remove software subject to the exploit, or for research into such exploits generally. There may be other legit uses as well.</p>

<p>Some years ago the Federal government attempted to prosecute a person for exporting a book describing how to create an encryption program. The courts eventually ruled that this was protected speech.  I suspect a similar ruling would be made in the sort of case described in the question, but the details would matter.</p>

<blockquote>
  <p>how can all this be legal?</p>
</blockquote>

<p>There are at least two <em>lawful</em>, possible uses of exploits. One is for research purposes, whereby an entity (necessarily an assembly programmer) analyzes the opcodes of the exploit to abstract its model. Having done that, the programmer is in a position to verify whether the in-house applications (or products, in the case of a software vendor) are vulnerable to that type of vulnerability, and therefrom proceed accordingly.</p>

<p>The second lawful use could be to achieve a <em>shortcut</em> to the targeted application's API and/or resources, thereby overcoming restrictions that might be permissible <em>in terms of licensing</em> but which the vendor is not interested in implementing upon customer's request. Given the high risk of costly system disruptions that this implies, it is utmost important for the programmer to know what he is doing when toying with these exploits for deployment in Production.</p>
