[peyton randolph]

I'm curious if they broke criminal laws in doing this.

How about?

Manufacturing a Surreptitious Interception Device 

Title 18, United States Code, Section 2512(1)(b)

Unauthorized Access to Protected Computers in Furtherance of Other Criminal Offenses 

Title 18, United States Code, Sections1030(a)(2)(C) and (c)(2)(B)(ii) 

Unlawfully Intercepting Electronic Communications 

Title 18, United States Code, Section 2511(1)(a)

 

Each of these is a felony with a maximum penalty of 5 years in prison and a $ 250,000 fine.

See the Loverspy spyware case via Google search for comparison.

[thoughtomator]

Yep, multiply that by the millions of CDs and that's one heck of a criminal penalty.