Some people have compared malware with guns. This is to me a very bad comparison, since guns actually have legal usage like hunting or self defense.
A better example would be a under cover cop, selling real drugs to real people with the intent to impress a local drug cartel. It has to my knowledge never happen, but it would be interesting to know if the cop could be held liable if someone dies from a overdose from those drugs.
Let say that a police virus spreads out of control, and infects millions of computers. What if this specific firefox exploit get copied by a botnet, and is used to execute credit card stealing software on unsuspected users. How liable can the police become when millions of people are effected? I really have no clue.