body: There are companies like Zerodium (Wikipedia: <https://en.wikipedia.org/wiki/Zerodium>) that buy "functional exploits" and sell them to "corporate and government clients". These are zero-day vulnerabilities, that is, vulnerabilities that are unknown to the developer of the software. Ethical hackers and professional security researchers typically report these vulnerabilities to the developer, so that they can be fixed. But companies like Zerodium buy these exploits and resell them to somebody else, we don't know who exactly. These people who buy the exploits from Zerodium are not going to use them legally, because as far as I know there is no reasonable way to use a zero-day exploit legally, other than reporting it to the developer (which they are not doing). Apparently the government is also buying the exploits from them, but that doesn't make it legal anyway.
  
  
  Somebody might think that this is more or less like buying and selling guns, which is legal in the US. However, it's not really like that. First of all, guns can be used for several legitimate purposes, from fun to self-defense, while zero-days exploits cannot reasonably have such purposes IMO. And then, we don't really know who companies like Zerodium are selling the exploits to.
  
  
  So how can all this be legal? Are there any specific laws in this field that allow it? Or are there any laws that would define this as illegal, or allow somebody to sue such companies in any way?
  
  
  
title: How can it be legal to buy and sell zero-day exploits in the US?