Allowing this is like allowing the development of engineered bioweapons and an open market selling them to the highest bidder.
1. Vulnerabilities exist in software, whether a researcher uncovers them or not. America's adversaries will continue to identify and exploit these vulnerabilities. So legislation that keeps this information out of the hands of our defense/intelligence community would really only serve to weaken us relative to our enemies, rather than making us safer.
2. Die Hard movies aside, software vulnerabilities are far less likely to lead to apocalyptic outcomes than nuclear or biological weapons. Maybe a better analogy would be the open market manufacturing of surveillance technologies, like cameras and radios. Where's the outrage about telephoto lenses that camera companies make that can be used to monitor our enemies or to take pictures of your daughter in your backyard swimming pool from a half-mile away?
Encouraging freelancers to find vulns and sell them to the highest bidder also makes us less safe. It also encourages vulns to be created in projects for the purpose of later selling them.
Secondly, the American point of view on this is colored by the fact the US has never been the target of a cyberweapon of the power of stuxnet, designed to cripple a large and critical military or industrial system.
I don't mean to be evasive by answering your question with a question, but freelance development of weapons that can cause widespread damage seems to be controllable. Why not quash the development sold-to-the-highest-bidder cyberweapons by the same means?
How would you control them? What would that policy look like? Want to take a stab at one? I'm interested in what people think should be done about this problem.
So you need something new to address the problem. I think that the answer is government legislation.
To be clear, I think that it's a terrible answer, in fact everything I'm about to write has glaring problems, I just can't come up with a better alternative.
So software suppliers have to be held responsible for the security of the products they supply, it would obviously be a long and arduous process, and would likely have serious repercussions on the industry as it stands today.
Flip-side is that you try to regulate the market for vulns to reduce their use in malware etc. you could do this by requiring companies to buy discovered vulns and require researchers to sell to the developers.
One of the many major issues with this approach is, what do you do about open source software. There's no money, so liability has no meaning. Here, if it's constituted into a commercial product (think all the lovely "appliances" out there) the liability passes to the guy making the money. Where an end-user company directly uses open source, they get the liability to go with it.
Along-side this you start slowly ramping up the security compliance requirements for companies and organisations processing transactions or personal data on the Internet.
I'd compare this to security becoming like "health & safety" . I don't think most companies really want to spend money on it, and I think a huge amount of money is wasted in unneeded process, but compared to the alternative, it has been seen to be the best approach.
O.K., so if I find an RCE in Windows 10, I have to sell it to Microsoft. But if I don't like the price I'm going to get from Microsoft, why wouldn't I just not independently find RCEs in Windows 10, and instead just sell engineering services to non-Microsoft companies who want to find and exploit those vulnerabilities themselves?
Obviously, you'd want to ban that kind of service. But how would you do that? What does that ban look like? A ban on reverse engineering? How do you differentiate the kind of reversing that Tridge did to build Samba from the kind of reversing HD Moore's team does to build Metasploit? Also: you want to ban Metasploit?
The question is, is that the best approach and if not, what is? Once an approach is agreed then the inevitable x years of wrangling on details could occur.
If a bunch of technologists (including vuln researchers) can't define a reasonable policy, I think it's a pretty safe bet that there's no reasonable policy to be had.
(KIDDING, CHRISSES.)
First of all, we do, in the Middle East. But bioweaponry development is orders of magnitude more difficult: when you accidentally release your bioweapon into your own shed you die and it may be detected from abroad, when you accidentally release your cyberweapon into your own LAN you reimage machines and no one from outside noticed unless you're incredibly stupid.
Likewise, bioweaponry distribution is orders of magnitude more difficult, if you don't maintain the bioweapon properly the weapon doesn't work, if you don't climate control properly the weapon doesn't work, if you don't weaponize and launch it properly the weapon doesn't work. Cyberweapons can be copied around on cards no bigger than my thumbnail, and maintain practically forever.
These problems go on and on. You're literally talking about controlling information and communications. NSA has enough trouble trying to read communications (and we're all working as hard as we can to close that ability), let alone to have government control that flow of communications.