Should governments tell vendors about the flaws they find, or keep them for spying?

Every government that finds a serious software flaw faces a choice: tell the vendor so it gets fixed, or keep it secret to use against adversaries. The United States has a process for it, the Vulnerabilities Equities Process, which decides case by case whether to disclose a zero-day to the public to improve general computer security, or to keep it secret for offensive use. It was developed in 2008-2009 and became public in 2016, after a freedom-of-information request by the Electronic Frontier Foundation.

The case for keeping secrets is intelligence. Reasons states keep a vulnerability secret include wanting to use it offensively. Zero-day exploits grew in importance once big companies encrypted their servers and messages, because the easiest way to a user's data became intercepting it before it was encrypted. The case for disclosure is that disclosing the vulnerability reduces the risk that consumers and all users of the software will be victimized by malware or data breaches.

The best-known test case is EternalBlue, an NSA exploit built on a zero-day flaw in Windows. The NSA did not tell Microsoft for several years, holding onto it for more than five years before the breach forced its hand. When a group called the Shadow Brokers stole it and it was released publicly in 2017, WannaCry used it to attack computers around the world, with over $8 billion in damages estimated across 150 countries.

Following public pressure for greater transparency in the wake of the Shadow Brokers affair, the US government published more about the process in November 2017.