From what I understand this counter-terrorism operation consisted in a well-crafted website that delivered malware to visitors by leveraging some undisclosed 0-

From what I understand this counter-terrorism operation consisted in a well-crafted website that delivered malware to visitors by leveraging some undisclosed 0-days. The obvious question is: if some malware is on a public website, who guarantees that only the "bad guys" will be targeted? If you don't disclose the 0-days, who guarantees that your own citizens won't be targeted by the same kind of exploits on the very same vulnerable devices? If you purposely keep a backdoor open in a device, who guarantees that the "bad guys" won't find that backdoor and use it themselves? Although I usually disagree with Google's decisions a lot, this time I can't see much wrongdoing in their action. Counter-cyber-terrorism is a double-edged sword, because it's about placing landmines and waiting for a bad guy to step on them. But nobody guarantees that only the bad guys will step on them. So it's probably time to end this "but we can do it because we're the good guys" rhetoric: it's very easy to get burned when you play with fire.