CFAA is criminal law with specific parameters. the accused must have attempted or conspired to attempt to bypass a restricted system. Demonstrating how to steal

CFAA is criminal law with specific parameters. the accused must have attempted or conspired to attempt to bypass a restricted system. Demonstrating how to steal money from a bank vault for example is not a crime, neither is teaching others how to do so for a fee or providing them with tools that can aid them in that endeavor. Especially when the other party is a government, it is reasonable to assume they will operate within the bounds of their own law. Red teamers, pentesters, security researchers, security training providers couldn't exist if the CFAA prohibited this. It isn't like their customers come to them and ask "hey, we're gonna spy on a journalist, can we buy pegasus". At the very least, it needs to be established that it is reasonable to presume pegasus will be used to break a law, it could be used for lawful reasons (which exist) and I'm sure they'll make their clients sign waivers to protect themselves fro such presumption. Anonymity isn't a crime (at least not yet), and it alone cannot be used to presume criminal intent. It isn't a crime to offer services anonymously. Perhaps not paying your taxes (if income could be proven) is something they can go after (and fail). The civil system can be used, if it is the government that is the plaintiff. Random companies suing is not enforcement since companies act in their interest, not in the interest of public policy and regulation. Waiting for events that align with corporate interests is not regulation, it is coincidence.