The use of such military weapons by civilians (or civilian police) against civilians become more obviously ban-able.
How long will it take for pentesting tools and end-to-end encryption to be labelled 'military weapons' under such a scheme?
Here's what we will find next: military and political leaders' phones have also already been compromised by NSO Group tools. I feel confident it has happened at a higher rate than among journalists. Imagine both your favorite and your most hated political firebrands: how will their rhetoric sound when they realize they've been pwned by the opposition for the past year using COTS tools?
That said we have near zero ability to enforce this at the moment.
Not sure it would stop the police part. https://en.wikipedia.org/wiki/Militarization_of_police
Pretty hard sell that it's a "military" weapon when you can carry it around on a thumb drive.
SCOTUS says that the 2nd applies to weapons which are “bearable”, i.e:
> "“[w]eapo[n] of offence” or “thing that a man wears for his defence, or takes into his hands,” that is “carr[ied] . . . for the purpose of offensive or defensive action.”
The closest parallel is probably an EMP strike. They're designed to inflict 0 casualties, but they cripple the enemy. That mirrors the usage of offensive software; they don't inflict any casualties directly, but they can ruin supply chains, remove communication capabilities from the enemy, etc.
They probably deserve to be classified as weapons, and banned by a subsequent law. I think the government has a compelling case that would almost certainly pass strict scrutiny. It seems a logical place to put them, because they are dangerous, and the strict scrutiny puts an onus on the government to use the least restrictive means possible to legislate them. I fear the alternative is that they aren't classed as weapons, and we get some overly broad CFAA type legislature that threatens to penalize security researchers.