Thread by @MalwareJake

Facebook paid a third party firm to develop an 0-day exploit customized for Tails and then gave it to the FBI to target a cyber criminal operating on their platform. I've been thinking about this all morning and I think I support the action. 1/
vice.com/en_us/article/…

But this one is really thorny to be sure. A critical point is that Tails was removing the vulnerable feature in a not-yet-released version, so that limited the time the vuln could be used by the FBI. There's no question this monster was targeting children and had to be stopped 2/

If Facebook used an OPSEC mistake and turned that data over to the FBI, this would be a non-story. The only reason we care is that Facebook subsidized the exploitation of another platform. Critically, FB notes they wouldn't have introduced risk for all users to aid the FBI. 3/

I wonder from an ethical standpoint:
1. Does this make it easier for the gov to compel others to work with them on LE matters?
2. Facebook has the talent in-house to develop the exploit, but outsourced it. Does that give them ethical breathing room or was that for PR fallout? 4/

3. If the vulnerability were in a competitor's platform, does that change the ethical calculus?
4. If the software were widely used, would that change things?
5. If FB paid for a vuln in a SaaS platform rather than end-client software, would that cross a line? 5/

I'm not getting outraged about this. I'm not sure what I'd have done here, but recognize these are some heavy issues.

We need to have these discussions on what is and isn't right (ethically and legally) because otherwise the next FB will make their decisions without us. /FIN

Also, forgot to note that this is yet another awesome scoop from @lorenzofb and if you're not following him, you should be.