Right. I don't think bounties like this alarm NSA in any way. In fact, since NSA probably believes it has a practically unlimited capability of acquiring Windows vulnerabilities, the bounty probably helps, by taking the heat off them and the intractable notion of a "vulnerability equities process".

I think it's more important to remember the NSA's primary goal in other security conversations. What you really don't want to do is propose protocols that leave plausible-but-difficult attack vectors for NSA, because "plausible-but-difficult" is probably inscribed in Latin on some seal somewhere in Ft. Meade.

I bet the NSA can and would pay a billion dollars for an exploit that was worth it, but other nation-states would be shut out from bidding simply because they couldn't even if they wanted to.

It would taken an extraordinary exploit to be worth that much, but imagine a flaw in some weapons platform used by an aggressor that's impractical or impossible to patch and allows for remote code execution. If the US was trying to fend off an attack, or was embroiled in a conflict where this would be an invaluable asset, could end the conflict overnight, they'd pony up.

Like if it could allow them to hack the enemy's radar system to render allied jets invisible, or could corrupt the firmware in anti-aircraft missiles to make them always miss their targets, that would be worth a billion. If it prevented the loss of a few high-value planes it'd pay for itself instantly.