A security researcher has taken umbrage at Italian malware developer Hacking Team after discovering that his open source exploit tools were included in Android surveillance software sold to governments around the world.

Collin Mulliner, well-known in security circles for exposing vulnerabilities in mobile devices, published a blog post Tuesday that attempts to set the record straight. To wit: his tools—which among other things surreptitiously capture conversations and other sounds within earshot of infected Android phones—were used without permission or notice by Hacking Team. He learned about the use only after the breach of Hacking Team computers, which resulted in a 400-gigabyte leak of confidential company documents, including these e-mails showing company engineers discussing Mulliner's tools.

In Tuesday's post, Mulliner wrote:

I'm pretty angry and sad to see my open source tools being used by Hacking Team to make products to spy on activists. Even worse is the fact that due to the lazy way they managed their source repository less informed people might get the idea that I developed parts of their tools for them. Just to make this very clear: I did not write any of those tools for Hacking Team. For the future I will use a license for all my software that excludes use for this kind of purpose. I have no clue yet how this license would look like so if anybody has a hint about pre existing open source licenses that exclude this kind of usage please drop me an email. Obviously Hacking Team also used other open source software such as Cuckoo Sandbox. I hope everybody is going to think about future license to prevent this kind of usage. I'm not a lawyer but I would be interested in what legal action one could take if their software license excluded the use case of Hacking Team.

Mulliner said he received an e-mail following the data dump from someone who formed the mistaken impression Mulliner designed the Android tools with Hacking Team in mind. He said the false impression is understandable when reading through Hacking Team source code , which along with Mulliner's Android Dynamic Binary Instrumentation tool, includes his name, website, and e-mail address. It wouldn't be surprising if Mulliner's contributions form only a small part of the open source software folded in to Hacking Team products, which leaked sales invoices show were sold to repressive governments in Sudan, Ethiopia, Egypt and elsewhere.