>The government’s ability to prevent software distribution is limited significantly by the first amendment. Selling “a tool for hacking” is fine, selling “a tool for committing crime” would be illegal, but that distinction just comes down to picking the right marketing copy. The government can however restrict the import and export of software quite broadly.
An interesting point. Given the vendor and customers for NSO's products, Federal law (in the US) would apply, rather than state law.
That said, an interesting parallel would be possession of burglary tools[0], which is a crime in many places in the US. However, given that "burglary tools" are generally just tools (e.g., bolt cutters), intent or mens rea[2] becomes important.
Presumably, a similar argument could be made about tools like nmap, nc, ettercap, metasploit, etc., since they can be used for legitimate purposes, even though they're also used for site intrusions/compromises.
NSO's tools, presumably, are mostly used for the latter rather than the former. I'm guessing (IANAL) that's one of the rationales used to restrict sales/exports.
Is that a convincing argument to criminalize activity and saddle it with strict liability[1]? I'm not so sure, but I'm also not a DOJ lawyer.
All that said, I don't think it's all just "marketing copy." As with most things, context and nuance matter. I make no judgement WRT the appropriateness of such restrictions, as I'm not in possession of all the facts.
Even so, while I tend toward the free flow of information, there is something to the idea that if you're caught at the back door of a jewelry store late at night with bolt cutters, that implies mens rea much more than having bolt cutters in the toolbox in your garage. YMMV.
[0] https://codes.findlaw.com/ny/penal-law/pen-sect-140-35.html
[1] https://www.law.cornell.edu/wex/strict_liability
[2] https://www.law.cornell.edu/wex/mens_rea
Edit: Fixed typo.