They will have to install an exploit on the target device. The law merely allows that practice.