> According to three former N.S.A. operators who spoke on the condition of anonymity, analysts spent almost a year finding a flaw in Microsoft’s software and writing the code to target it.

So we spent significant government money finding and and developing an exploit for the CVE. Yes, someone else could have found it too/instead.

But what if instead, our government had spent that significant money finding the exploit... and getting it patched for everyone. Would that not have made us all safer?

We are choosing to fund an enormous "black hat" operation, when we could be funding an enormous "white hat" operation instead.

Theoretically, there is a government policy that it is the "default" to disclose any vulnerability found by national security, with a (secret of course) process to go through to argue that a vulnerability should instead be kept to be weaponized.

I am dubious to what extent that has actually changed practice at all. The times the vulnerabilities were kept undisclosed would of course be secret, but in theory all the times an NSA-discovered vulnerability was disclosed should be public record somewhere. I haven't seen such a list, not sure if anyone has tried to make one or if it's available at all. Theoretically the government policy is that disclosing vulnerabilities should be the standard and default behavior except in unusual circumstances. I am dubious. And it is putting us all at risk.

> One month before the Shadow Brokers began dumping the agency’s tools online in 2017, the N.S.A. — aware of the breach — reached out to Microsoft and other tech companies to inform them of their software flaws. Microsoft released a patch, but hundreds of thousands of computers worldwide remain unprotected.

The scandal is that they tried to keep this vulnerability to themselves until they realized it had been stolen. If they had disclosed it to vendors when they found it, there would have been that many more years for patches to be distributed.

Instead they not only kept it secret in the vainglorious belief they had the power to keep it secret, but wrote the exploit that was then leaked, providing a powerful off the shelf exploit now available to anyone. Sure, someone else could have done that. But it was our tax dollars that actually did it. I'd rather have my tax dollars patching vulnerabilities than writing weaponized exploits for them.