The most successful ones work for the feds while squirreling away the proceeds. The feds don't mind cultivating crime if it's increasing their numbers.

Actually, criminal copyright infringement is a $250k fine, 5 year felony, in the US. Pretty amazing. You are vastly more likely to be prosecuted criminally if you're part of a group, and especially if you focus on 0-days. Even more likely if you sell things, charge for advertising on your site, etc.

The DrinkOrDie people got a lot of 3-5 year sentences. http://en.wikipedia.org/wiki/Operation_Buccaneer

Parent posts are probably talking about 0-day exploits rather than 0-day warez.

Doh, of course.

DMCA still makes some 0-day exploit research not totally safe, either. https://www.eff.org/wp/unintended-consequences-under-dmca I don't know if anyone has been successfully convicted, but a lot of prosecutions have come up, and that's enough to deter many people.