It's a little naive the way the article repeats that the software is "only for use in criminal investigations."

1. Outside of first-world democracies, one of the main purposes of criminal investigations is to find political dissidents so they can be threatened, jailed, tortured, or "disappeared."

2. Another country's definition of "crimes," "criminal" or "investigation" may be very different from yours. In the USA we have due process, presumption of innocence, double jeopardy, rules of evidence, speedy trial, reasonable search and seizure, prohibitions on ex post facto laws, Miranda rights...in other countries, maybe there's a court and a trial, but with a 95%+ conviction rate and no questions are considered relating to the reliability of the prosecution's investigation process, arguments, witnesses or evidence. Or, when you're accused, you're simply tortured until you confess, and the torture is effective enough that most people confess (or extreme enough that people who don't confess usually die). And the types of laws that they have may mean that dissidents are actually criminals -- for example, if it's illegal to criticize the regime in any way, then all dissidents are criminals by definition.

3. Most evil regimes have a secret police (it's practically part of the definition of "evil regime"). The thing that distinguishes the secret police from the regular police is that the former are, well, secret. An oppressive government wouldn't come out and say to a First-World seller of such surveillance software, "We're going to use this for criminal investigations and secret police actions." Instead they'd say, "We're going to use this for criminal investigations," and once they had it, expand its use to the secret police without telling anyone.

4. Even if it's not sold directly to the worst regimes, it may wind up in their hands anyway, through bribery, espionage, a sequence of individually legitimate, indirect trades through neutral nations, or plain old software piracy. The fact that software is not a physical item and can be moved through networks or tiny, unobtrusive, common devices like SD cards or USB drives, perfectly disguised through encryption, and duplicated at virtually zero cost makes it much easier and less risky to steal and/or move across borders than would be the case for physical items like guns, artillery, aircraft, etc.

5. Independent invention is also possible. There are plenty of countries with the money and technical know-how to develop something like this (ahem Russia ahem China), who aren't shy about cracking down on their own political dissidents and presumably wouldn't mind selling the software to like-minded regimes for money or political favors.

6. With postmortems on infected PC's, or sufficiently detailed reports of dissidents' activity leading to arrest, the outside world might figure out what happened, as appears to be the case in this article. But by then there's not much we can do, short of the usual ways the international community tries to improve human rights -- multilateral negotiations, diplomatic pressure, economic sanctions, UN peacekeepers, limited military strikes, full-scale invasion and regime change. None of which seem to be particularly reliable or effective.

The reason this type of software hasn't been much noticed until recently is that despotic countries are often relatively backwards in many ways, so (I'm guessing) most tyrants haven't had to worry much about Internet-organized dissidents until enough of their population got Internet access for it to become an effective tool for activists, which (I'm guessing) only happened fairly recently in most such countries.