Generally, within the United States, would it be legal to:

  1. Develop an advanced network exploitation system that has capabilities like The NSO Group Pegesus Spyware.
  2. Market that software to any US based persons or entities.
  3. Sell to any US based persons or entities.

If the programs only reasonable use is to gain unauthorized access into protected systems by subverting security messures, would this make it illegal to develop and sell? This assumes the distributor has no specific knowledge of, nor intends to seek information on the buyers actual intended use of the Software.

Basically, is there any law that prevents hackers from selling malware they made in the past to anyone, if they don't have specific knowledge that a particular buyer will misuse it?

  • Not it does not. My question deals with the case where the program is specifically designed to perform an act that enables cybercrime. My question is 'Is it illegal to sell cyber weapons (malicious software) in the United States without restriction?' Commented May 10 at 21:59

1 Answer 1


It depends on the intent

There are legitimate and legal reasons for selling malware: for “white hat” penetration testing, law-enforcement, military applications, etc. However, if the Crown can prove intent for it to be used illegally, then the perpetrator is guilty of supply data with intent to commit a computer offence, contrary to section 478.4(1) of the Criminal Code 1995 (Cth).

Not the answer you're looking for? Browse other questions tagged .