Legitimate (hacking) business? --- Important question, Bennette. On one hand, states may decide what is legitimate business in their jurisdiction; for instance, in many jurisdictions 'pen testing' (ie testing the resilience of an organisations' IT system by an third party as a contractor) is legal.

On the other, giving a clear legitimacy to a 'hacking' business which clearly conducts attacks against third parties (particularly abroad) without the consent would not be well accepted abroad - and thus, no state really 'allows' this publicly.

But, what is the grey zone? For instance, the NSO Group in Israel which produces most sophisticated weapons (built on zero-day exploits) for hacking into mobile phones - but it rents it to others (foreign security services) rather than conducting attacks on their own? Contrast this with many ransoware-as-a-service offers on a grey market, where criminals rent a full set of malware and tools to conduct a ransomware - but this is illegal (perhaps because their clients are formally not governments)?

Source author: Vladimir Radunovic vladar@diplomacy.edu