> They are still here to protect americans

That may be the charter of the the organization. But the individual people running the FBI goals are to 1) be reappointed / not get fired 2) continually expand their budget / power. Given US politics 1&2 are not always congruent esp in short term with "protecting americans".

They were perfectly happy to use the vulnerabilities exploited by Stingray after all.

Don't mix up the existence of incentives with the idea that you have insight into what people's goals are.

Have you ever interacted with law enforcement on any professional basis?

They aren't like that at all.

1) yes, but with the "troops" and lower level managers.

2) the Director of the FBI (and other other high level managers) is much more of a political bureaucrat than they are a LEO.

While it may be true that in this particular instance the FBI might act benevolently, the idea was that it would be nice if there was an organization you could go to with any zero day bug. Even if the FBI is not mismanaged and always tries to protect Americans, you could easily imagine a scenario where someone reports an exploit to an OS where anyone can remotely install a key logger. The FBI wouldn't be a good organization to report this to because they may want to use this to track down criminals which, they would no doubt feel, would greatly outweigh the cost to Americans that the zero day represents.

The EFF seems like a good choice. In general you would need to pick an organization that does not have a vested interest in using exploits.

> While it may be true that in this particular instance the FBI might act benevolently

Indeed. Didn't the FBI effectively purchase a zero day to break into the iPhone of the San Bernardino shooter? Didn't they also then not disclose said zero day to Apple?

There's no way that any LE agency can be trusted with this responsibility; I'm not convinced that it can be done by the federal government at all. EFF seems like a reasonable choice, but even non-profits have the potential to be corrupted/subverted (and operating as a dump for zero days has the power to corrupt, for sure, regardless of how moral your organization claims to be on its website).

This definitely falls under the umbrella of hard-problems-in-politics-that-will-not-be-solved-any-time-soon

What if there were multiple non-profits that can keep each other honest?

What makes you say that? Plenty of evidence points to upper management at the FBI and other 3 letter agencies being more interested in power brokering than honesty and serving the public.

So what happens if you find a zero day vulnerability in a Russian bank? Not everyone on the internet is from the US.

Then you don't report that to the FBI, it's not their jurisdiction.

It's good to have this as a general reminder: "Not everyone is from the US", people tend to forget that so often :)

It'd be tough to form an international legal entity anyways.