Is it just that the NSA is unwilling (legally prevented?) to share their toys? Its hard to imagine they don't have capabilities like this.
One of the few good things revealed by Edward Snowdens leaks was the fact that the NSA has filters for intercepted communications to filter out comms from US citizens. This was in top-secret programs that had no reason to be publicly known, and yet the NSA still had these filters installed anyways, because everyone in the NSA understands that they're not a law-enforcement agency, because of Posse Comitatus.
https://www.aclu.org/news/national-security/five-things-to-k...
Strictly speaking, that's not correct. The Posse Comitatus Act just changes the status of using the military as a police force from “allowed because any person or group can be deputized as a police at any time”, to “the US military can be used as a police force only under the laws specifically allowing and governing the US military as a police force.”
(Of course, the Posse Comitatus Act is a criminal law, which means in practice the primary mechanism for enforcing it is for the executive branch to arrest and prosecute offenders. This works tolerably well to prevent, say, a rogue sheriff calling up his buddy who happens to command an infantry company to come help out, but not particularly well to dissuade the President from directing the military for policing as a matter of Administration policy.)
In principal the courts can constrain the government based on it, as well, but it is noteworthy that the determination that the deployment was illegal in the case filed by the State of California almost immediately when courts were open after the initial LA deployment was announced on June 7 and before troops arrived on June 10 was just released, on September 2, nearly 3 months later. And is on hold for 10 days to give the government time to appeal. So, one might consider the courts to not be a meaningful constraint, here.
(2) NSA does not in fact have to outsource spyware (they may do it for convenience/situational logistics).
(3) US federal law enforcement and intelligence agencies all have multiple vendors for this stuff.
Like at the very worst - selling "cyberweapons" would follow the same rules as selling actual weapons.
I don't super follow US politics, but i don't think we are at the point where ICE is comitting crimes against humanity - which i think is what would be required for this transaction to violate international law.