Link to more info about export controls for this kind of technology?
It looks like they sold software that could breach whatsapp security. Where can I read more (something that's understandable) about how this is export restricted?
If it was export restricted, who is responsible for enforcing the law?
>4. A. 5. Systems, equipment, and components therefor, specially designed or modified for the generation, command and control, or delivery of "intrusion software".
https://www.wassenaar.org/participating-states/
Click on your country and it should point you to the relevant authority for your government.
As I understand it, VUPEN was buying exploits before the exploit section was added to the Wassenaar agreement. They attempted to dodge the agreement by moving the company from France to Singapore (which is not a Wassenaar signatory), but then Singapore still added the exploit section to their laws [0]. VUPEN shut down before that law change anyway, due to bad press from the Hacking Team leaks.
Who is tracking / investigating what just happened? How would they even know?
Would getting an export license even be possible?
For you selling to Zerodium, it would be the government agency in your country in charge of managing export controls. Unless you are bragging about it on social media, it is unlikely that they would know about you selling the exploit. As long as Zerodium doesn't tell your country about you selling the exploit, it will be very difficult for your country to find out (unless they investigate where you are getting tens of thousands of dollars from).
For Zerodium reselling, it primarily falls under the US Department of Commerce’s Bureau of Industry and Security (BIS). If they are selling to somebody nasty the Department of State's Bureau of International Security and Nonproliferation could be involved, along with Homeland Security. Since Zerodium is very public about buying and selling exploits, they are certainly on the radar of these agencies. If they don't see Zerodium applying for export licenses, they will investigate.
>Would getting an export license even be possible?
Contact your local government. It might be difficult to do so as an individual, so you could need to form a small company.
I think this law changes everything when it comes to trading exploits.
What would they get in taxes from that million bucks? Export controlled things still get sold all the time, look at any country with a weapons industry. The goal of licensing is to control who they get sold to, not to stop them from being sold.