> <i>But they did so quietly and without notifying the developers of Tails afterwards of the major security flaw,</i><p>I don't immediately see an ethical problem with developing a zero-day exploit to catch a suspected/presumed very bad person like that, so long as: (1) it's used only for that one target; (2) you promptly start the responsible disclosure to upstream, and later public.<p>Unfortunately, the nice, clean ethics gets more complicated when that zero-day is temporarily in the hands of an organization that would presumably also use it for other targets.<p>Historically, some good and important government organizations have had complications, such as some personnel not believing in the rules and checks&balances under which they're supposed to operate, or personnel acting under direction of leadership or outside politicians who're misaligned with national laws and values.<p>If someone with the ability to develop a zero-day wanted to catch the very bad people, while not compromising all the lawful civil rights leaders and journalists who bother some questionable politician, how would they do that?