How can it be legal to buy and sell zero-day exploits in the US? There are companies like Zerodium (Wikipedia: https://en.wikipedia.org/wiki/Zerodium) that buy "functional exploits" and sell them to "corporate and government clients". These are zero-day vulnerabilities, that is, vulnerabilities that are unknown to the developer of the software. Ethical hackers and professional security researchers typically report these vulnerabilities to the developer, so that they can be fixed. But companies like Zerodium buy these exploits and resell them to somebody else, we don't know who exactly. These people who buy the exploits from Zerodium are not going to use them legally, because as far as I know there is no reasonable way to use a zero-day exploit legally, other than reporting it to the developer (which they are not doing). Apparently the government is also buying the exploits from them, but that doesn't make it legal anyway. Somebody might think that this is more or less like buying and selling guns, which is legal in the US. However, it's not really like that. First of all, guns can be used for several legitimate purposes, from fun to self-defense, while zero-days exploits cannot reasonably have such purposes IMO. And then, we don't really know who companies like Zerodium are selling the exploits to. So how can all this be legal? Are there any specific laws in this field that allow it? Or are there any laws that would define this as illegal, or allow somebody to sue such companies in any way?
Note that what is being bought or sold here is actually information about the exploit. Attempting to criminally penalize the transmission of information in the US often runs into First Amendment issues. If a person has good reason to know that information is going to be used to commit a crime, or is likely to be so used, and there is no plausible legitimate use for the information, that person might be charged with complicity or conspiracy for distributing the information. But where there are legitimate uses, that is much less likely. Here the information could be used to defend against the exploit, or to identify and remove software subject to the exploit, or for research into such exploits generally. There may be other legit uses as well. Some years ago the Federal government attempted to prosecute a person for exporting a book describing how to create an encryption program. The courts eventually ruled that this was protected speech. I suspect a similar ruling would be made in the sort of case described in the question, but the details would matter.
Recall the basic principle of copyright law, as detailed in 17 USC 106: The copyright holder has the exclusive right to make copies; prepare derivative works; or distribute copies by sale, rental, lease, or lending. Other people can legally do these things only if they are given permission by the copyright holder, typically via a license. (Remember, the literal meaning of the word license is permission.) Often, the copyright holder will require a prospective licensee to accept various terms and conditions before the license will be granted. If there is &quot;no EULA&quot;, or if there is one but the purchaser has not agreed to its terms, then the purchaser has not been granted any such license, hence does not have permission to do any of the things listed above. If they do so anyway, it is illegal copyright infringement and they will be liable for damages. To use a firewall analogy, copyright law is &quot;default deny&quot;. So let's take your questions one by one: Do they own the software? US law has no concept of literally owning software. The closest thing is owning the copyright, which the purchaser certainly does not. It still belongs to the vendor that wrote the software (or whoever they may have later transferred it to). Can they legally alter the code of the program they purchased? No, that would be preparing a derivative work. The copyright holder has not granted them a license to do that. (There are some exceptions for purposes such as reverse engineering and interoperability, see 17 USC 1201(f)). Can they legally redistribute it No; again, that is the exclusive right of the copyright holder, and the purchaser has not received their permission. or transfer ownership? Maybe, if the first sale doctrine applies. Its application to software is complicated. The user has a better case for being able to sell the software if it exists as some tangible object which is transferred (physical media, pre-installed on hardware, etc). Can they legally modify the code of the program for others who have also purchased the same package? No, that would be preparing a derivative work. Can they take that software and install it on a secondary machine? No, that would be making a copy.
There is also the part that says &quot;except as expressly permitted by law&quot;. In the USA, you are allowed to run the software. This means the operating system making the copy that transfers the software from your hard drive to the RAM of the computer, and all necessary changes there. And this includes modifications to relocate the software, or to protect it against certain attacks by hackers, and I'm confident that Apple checked that it includes translating x86 machine code to ARM machine code and store the translated copy together with the original. Similar things have been done already around 2000 or so, and no software manufacturer has ever complained.
There are professionals who are doing penetration testing in an attempt to find security vulnerabilities with the target company. They will have a clear, written contract with the target company to permit the attack. Professional conduct means making sure that the permission is genuine before starting the attack. Their aim is to map weak points in the security, not to extract personal data. There will be non-disclosure agreements to make sure. Reports go to the target of the attack, not to any third party. As you describe it, it looks as if scammers are setting you up as the fall guy for their schemes. They and the money will be gone, you go to prison.
On the one hand, there are statutes that prohibit the delivery of instructions which distort or circumvent the official/intended use or safety of a device. For a somewhat related example of this, see MCL 750.540c(1)(3). On the other hand, the company/manufacturer is unlikely to prevail under contract law no matter how clearly and conspicuously its EULA prohibits the disclosure of discovered weaknesses. That is because the prohibition in the EULA is outweighed by the severe vulnerability to which all other unsuspecting customers are subjected. From the standpoint of public policy, people's awareness of the discovered vulnerability is certainly in the public's best interest. The disclosure will warn both (1) potential customers not to purchase a product that fails or misses its primary purpose, and (2) current customers to adopt precautions now that the product's reliability has been disproved. Thus, the effectiveness of broadcasting the discovery of such weakness is in stark contrast with the technical deficits and managerial politics that typically hinder a company's ability (or its will) to respond to the issue. If the weakness was known to the manufacturer prior to the disclosure, the release of that product would constitute fraudulent misrepresentation. The details of the demonstration in the video supports the argument that the manufacturer knew --or should have known-- about that weakness, since a padlock design is supposed to pass all kinds of tests of breakability and not be disabled by a screwdriver. It is hard to deny that the notion that "the padlock is secure" induces customers to purchase the product. As such, the misrepresentation violates the contract law principle that a contract --such as a purchase-- be entered knowingly. See Restatement (Second) of Contracts at § 161-167. With respect to the publisher of the weakness, that misrepresentation renders the EULA-prohibition void. See Restatement at § 164(1). Regardless of whether or not the manufacturer incurred misrepresentation, the manufacturer's decision to sue the publisher is only likely to backfire by bringing more attention to the poor design of the product. In all, the manufacturer's best option is to do a product recall ASAP and enhance the design.
united-states The license won't let you sell the .stl file. Probably you have created a derivative work, which means you can't sell it without a copyright license (and the CC-A-NC won't do). If it were licensed under CC-A you could sell it without problems (you'd have to give attribution, of course). You could also sell it under the CC-A-SA, but once you do you have no control over the result -- anyone you sold it to could give it to someone else under the terms of the license. This could work, though, if it were (say) a commission and you only expected to sell one copy. I don't know what the situation would be with the physical objects printed under any of these licenses.
united-states There is no general rule against one company or person buying both broadcasting rights and merchandising rights to a particular piece of content in the US. There are anti-monopoly/anti-trust laws, but those generally only apply if a particular entity holds a monopoly or a commanding market position in a whole market sector. If one firm held the rights to 80% of all online games, for example, an anti-trust action might well be warranted. But a single game or property is not generally considered to be a market sector for anti-trust purposes. Exactly what the proper market sector is in such cases is often a complex, technical, and highly disputed issue. The &quot;original owner of the IP&quot; can decide who s/he wishes to sell that IP to -- nothing requires, or forbids, that different sets of rights be sold to the same buyer. The original owner will attempt to get the best deal available. Sometimes that is a very lucrative deal, and sometimes it is far from that. As long as unlawful methods are not used to induce a sale, whatever bargain the parties make is generally acceptable to the law. I do not know who did, or did not, buy any of the rights to Squid Game, and that info might not be publicly available. But there is no law that I know of against the same party having both broadcast and marketing rights to it, and perhaps other rights as well.
You cannot do this through any established public license that I know of, but you could write your own. The model would be any educational use or non-commercial use license, such as CC NC licenses. The main challenge is defining the excluded classes of usage. That is why you should engage an attorney to draft this for you. I don't think there is any point in adding a $5M penalty clause. You offer a separate paid license for individuals who do not want to comply with the particular terms of your license, and set the fee to whatever you want. Saying that you're gonna fine violators is a bad idea because penalty clauses are illegal. Instead, the standard approach is a liquidated damages clause, where you state what a reasonable estimate of your damages would be. In the case of software that is available for purchase, illegal copying of the software obviously results at least in the cost of the software qua lost revenue as damages. Plus shipping and handling.