When an individual acquires a zero-day and turns it into a product to be bought by people to freely target users of the vulnerable software, they are treated like a crook. When Cellebrite do it, it should be no different. Here is the statement from Cellebrite on the matter: “We do not disclose or publicize the specific capabilities of our technology. This practice is central to our security strategy, as revealing such details could provide potential criminals or malicious actors with an unintended advantage.” A software developer is entitled to know that their software is being / attempted to be exploited by a wealthy, influential actor. This is called responsible disclosure, a virtue of the security community these companies don't follow. What we do against these groups is an act of self-defence of our product and work. GrapheneOS, Google, Samsung, Apple and the greater mobile security community is neither a "potential criminal" or a "malicious actor". These authoritarian talking points are stale and come from the same playbook as "Think of the children" and other fallacy phrases meant to attack you as being a danger for something as simple as wanting to protect yourself. Vulnerabilities don't just exist for the bad guys. All vulnerabilities are to be patched when uncovered. At the bare minimum, a single so-called illicit use of it anywhere in the world immediately makes their exploit a cyberweapon that must be neutralised. Them being an exploit alone is the only justification we need to seek disrupting these threat actors' work.