I'm still deeply confused about the legality of Hacking Team and other similar vendors. In particular where is the line between the legitimate (I think) site se

I'm still deeply confused about the legality of Hacking Team and other similar vendors. In particular where is the line between the legitimate (I think) site selling 0-days and corporate surveillance tools and the recent hacker forums where a bunch of kids were arrested for making and selling Android malware.