strong_opinions

Good. Such vulnerabilities should always be reported and fixed, no matter who is abusing them. And it's even better if it wrecks a government operation, they shouldn't even be using these, they should always be reporting them to the software vendor.

I hope this doesn't discourage Google's threat analysis team, and others, from doing the same in the future.

The justification for not intervening is weak too - after all, we only have this article's word for it that the targets were 'terrorists'. They may well just have been freedom fighters, like Nelson Mandela was.

This is why we need a corporate death penalty, to destroy abusive companies like this.

The company and all its investors and directors should have all their assets seized, even those not related to the company. In addition to any relevant criminal charges being applied.

If we had a few instances of this occurring for the worst offenders, you can be sure other companies would swiftly clean up their acts.