[pierat]

Selling exploits (the words explaining how to) is a 1st amendment protected act.

Actually downloading the data from a hack and selling it is expressly illegal.

Now if the person/group you're selling to expresses illegal actions as a result, you have a duty not to sell. So, don't ask, and dont tell!

The real solution: companies all should allow for bug bounties and good-faith reporting and proper compensation for reported issues. But as long as they don't another group WILL pay.