Well, the US government buys exploits from people [1], which means it must be legal in the US. The government would never do anything against the law, right?

[1] http://www.techrepublic.com/blog/security/guess-whos-buying-...