I believe the complaint here is not that they were analyzing the software, but that they were launching <i>active attacks</i> and using the results in an unethical manner, i.e. to conduct possibly-illegal criminal investigations. This is Not OK in the same way that it&#x27;s Not OK to go around breaking into people&#x27;s houses with lockpicks and searching them on the grounds that you are conducting lock research. Note that I understand that physical lock security is a relatively well-settled field. That is not relevant to the point at hand; even if it were an important thing to study, it would be Not OK for the government to be paying people to go around picking locks.<p>Edit: Furthermore, by the same logic, it is acceptable for the government to do nearly anything illegal in order to conduct &quot;research&quot;. Microsoft, Google, and co <i>claim</i> to be secure, so therefore it should be OK for the government to be attacking them.