Was GP generalizing, or overspecifying? Because from where I sit the responsibility (for not notifying Microsoft) does appear to lie within the Departments of Defense and Justice, and I wouldn't be surprised if the Venn diagram for the split responsibility is based on a simple division of labor.

You can't pin that on spy agencies. Criminals would have exploited the same holes eventually. Manufacturers and software developers could just start using better languages and better development practices instead of whinging every time their C/C++ software is trivially owned.

Officially, the NSA's role is not to sit on zero-day exploits. If it discovers zero-day exploits (either by accident or through active research), then it should follow industry practices for disclosing and patching it[0].

[0] There are discussions of what constitututes "industry best practices", but I think we can all agree that "telling nobody, including the software vendors, with the hopes of being able to exploit it later" does not qualify.

You might argue whether or not NSA should be into 'hacking other people with 0-days' business or 'making computers more vulnerable' business, but NSA definitely is not in the business of making computers less vulnerable. Especially for computers located in other countries, they have no business helping to protect them - that's against their role, they're paid to facilitate the exact opposite goal.

Third possibility: their role involves securing domestic infrastructure, in which case they should be looking for vulns and getting them fixed. IIRC this actually is part of their statutory mandate, alongside offensive operations.

That being said, it still wouldn't help against WannaCry because Microsoft made a blunder when they disclosed the vuln by patching new versions of Windows while they left majority of XP installations unfixed. Even without the NSA leak somebody may have reverse engineered the bug from the released updates - such things happened in the past.

This sounds similar to what IAD does. The difference is that IAD focuses on securing systems against entire classes of vulnerabilities and attacks.

SID has the mission of gathering signals intelligence, so that is why it makes sense for them to utilize individual zero day vulnerabilities. They need to get into an adversary system, so vulnerabilities are required (when needed) to get that access.

I don't have any old versions of Windows installed, so I truly don't know how it rolled out there.

Last time I spoke with the NSA, admittedly over a decade ago at a college recruitment event, they were in that business as well. So much so that they created a hardened version of Linux that a lot of us today [0].

[0] https://en.wikipedia.org/wiki/Security-Enhanced_Linux

In addition to it's main role of collection of foreign intelligence data (which includes breaking encryption and finding/making vulnerabilities), it does have a secondary mission of protecting US government systems. Hopefully that does mean that they have ensured that US gov't systems have been patched against those vulnerabilities. For example, Microsoft patching the SMB vulnerability (including for WinXP) before it was made public was likely done after a report from NSA, and would be consistent with such a goal. Having "private" custom patches that would get installed in sensitive gov't systems but not made available to general public would also match this goal.

However, the relationship of NSA and the main victims of WannaCry are at best neutral. For example, it seems reasonable that NSA should want companies like Spain's Telefonica to stay vulnerable to various exploits - their mission explicitly includes obtaining intelligence from (among other sources) foreign telecommunications operators, so if they had the ability to protect Telefonica, then doing so would go against the mission given to NSA by the congress.

In the same vein, the NSA isn't about protection. That's not their role, just like the point of the military isn't protection.

I'd argue that it is, if indirectly.

So it leads to the same logical conclusions: If the point of the military is to apply force to an opponent, then the NSA has to have ways of applying force to a digital opponent. Disclosing vulnerabilities would be precisely the opposite of what they should do.

Examples from the last 50 years?

I've repeatedly said on HN -- if the US tech companies can't build the most secure systems possible, the US government itself will not be able to secure their own systems. Secure devices and communication is not a given nor will it become easier.

They are military. It was a cyberweapon. That's the point of a cyber weapon. Russians stole it from the NSA. Yes, that's incompetence, but an attacker only has to get lucky once. It's much harder to defend a cyberweapon than a tomahawk missile.

Does that mean we shouldn't build cyberweapons? No. That's just how cyberweapons are. That's the reality we live in now, and the world will just have to deal with it. There's nothing to be done, is there? Not unless you're suggesting that computers should never be used for offensive capabilities, which from a game theory perspective means that country will be powerless in the digital arena.

Don't do the crime if you cant do the time.

Personally, I'd rather our military NOT be full of people who are willing to do this kind of thing.

If this discussion was about missiles, and the gov agency in charge of the missiles were using them on Americans, I'd say that they should go to jail as well.

You are right. These cyber exploits are weapons. And they should stop using those weapons on Americans, as a multitude of leaks have shown that they do, through mass spying and mass data collection programs.

They are not allowed to upgrade automatically because their software will break. The cost to upgrade the software isn't feasible when you have a multi-billion wide gap.

Edit: Umm, humans have formed armies and started wars over far less theft and far lesser threats to their populations than this. If the attackers are located, some piano wire around their necks is really cheap in comparison. And for this amount of damage, I do not doubt for a moment that it's a consideration by every single government spy organization.

Maybe leaving my front door unlocked was a bad idea, but you still robbed my house.