>>* From my experience, they're not at a level of competence where the malware helps significantly, i.e. for low level crime you don't need it, for highly sophi

>>* From my experience, they're not at a level of competence where the malware helps significantly, i.e. for low level crime you don't need it, for highly sophisticated crime you won't have a lot of success with off-the-shelves attacks.* There is a danger that comes from thinking of these problems as theoretical. They aren't. We have a history, a present. History (germany knows this more than most) is that a surveillance-centric law enforcement is the basis for a repressive regime. The stasi wasn't a coincidence. The present shows us that state surveillance is on the rise. Again germany makes a fine example. Already repressive regimes (like Belarus, currently) give us an easier to grok understanding of the mechanics. It's easy for us to agree that it's bad to supply these to bad regimes. If Lukashenko uses german software operated by german mercenaries (I believe this is a precise definition of the term) to find and arrest his dissenters, germans will feel that this company is bad. That's easy. But, that company can migrate and I doubt export bans would have denied Luka much or changed the game meaningfully in Belarus. It's effectively symbolic. What is more important is for germans to ban their own governments from doing this, or at least strictly restrict it to counter-terrorism. If any police department can hire mercenaries to "do cyber-policing," we get to stasi situations quickly. Unlimited power is a bad thing, a dangerous thing.