"In a sense, Zerodium is a cyber arms dealer. It pays hackers to learn about their tactics, then packages that and sells it to elite subscribers.
For $500,000 or more a year, governments could buy a road map for hacking Android phones to spy on people. Companies could learn about a special hacking tactic before it's used on their own Windows computers -- or quietly use it themselves for corporate espionage."
So they are selling to governments (which make laws and make this legal).
"In a sense, Zerodium is a cyber arms dealer. It pays hackers to learn about their tactics, then packages that and sells it to elite subscribers.
For $500,000 or more a year, governments could buy a road map for hacking Android phones to spy on people. Companies could learn about a special hacking tactic before it's used on their own Windows computers -- or quietly use it themselves for corporate espionage."
So they are selling to governments (which make laws and make this legal).