> this is exactly what I expect a spy agency would be doing
From Wikileaks' overview:
"In the wake of Edward Snowden's leaks about the NSA, the U.S. technology industry secured a commitment from the Obama administration that the executive would disclose on an ongoing basis — rather than hoard — serious vulnerabilities, exploits, bugs or "zero days" to Apple, Google, Microsoft, and other US-based manufacturers.
...
"Year Zero" documents show that the CIA breached the Obama administration's commitments. Many of the vulnerabilities used in the CIA's cyber arsenal are pervasive and some may already have been found by rival intelligence agencies or cyber criminals."
By not releasing this information to technology companies affected, they are increasing the risk of the same exploits being used against high profile US targets.
Not to nitpick, I absolutely agree that the NSA should be responsible for disclosing this type of information to help secure the USA and its infrastructure.
The CIA on the other hand has clear (though not always followed) directive to only act outside the US and to act against foreign nationals.
It's less clear to me that they should be required to disclose these. Another post makes the claim that the CIA may have lost these, that case seems clearer that they must disclose to protect US interests.
The problem is that there are very few IT systems that are purely foreign.
For example, if the CIA finds an exploit in a wireless router made in China and sold all over the world, that hole can also be found by others and used against targets in the United States.
Is being able to hack others worth letting ourselves get hacked?
> Is being able to hack others worth letting ourselves get hacked?
The answer to this for me is a clear no. What I was more questioning is given the CIA's role and job, I don't think it's necessarily their responsibility to do it. We're talking about a government agency who's purpose is to collect information about potential threats against the US, they have no reason to want to make that harder on themselves.
If you want to debate changing the role of the CIA, and if or if not it should exist, that's a different set of questions. But given what their job is, why would they want to turn that funnel of information off? It's not in their interest to do that.
I want everything to be hyper secure on the internet, but I also know that there are threats against the US (some created because of our actions) which the CIA is responsible for trying to keep an eye on.
A similar question: is it worth being hacked so that we can know that there is an imminent attack coming against some US interest?
EDIT: I know that the CIA is responsible for some really ugly things in the world, I'm not defending any of those actions. I'm speaking more of what their theoretical function is and what responsibilities they have in disclosing some of this information.
If you want to debate changing the role of the CIA, and if or if not it should exist, that's a different set of questions. But given what their job is, why would they want to turn that funnel of information off? It's not in their interest to do that.
However, the CIA is still a part of the US Government, and as such it still should have a responsibility to work towards outcomes that are best for the US overall. When this appears to be in conflict with their direct mission, in many cases the correct response should be to punt the decision upstairs.
You wouldn't expect the US Forestry Service to take decisions harmful to the overall country even if it made their direct mission easier, would you?
If while performing counter-intelligence the CIA discovers that a foreign government/company can/is exploiting computer systems within the US, should the CIA have a responsibility to do anything?
I don't believe the clear answer to that is Yes. I'm not sure if it is No either. Maybe they should share that intelligence with the NSA, but I can imagine if sharing that intelligence would compromise the the mission of the CIA then they wouldn't.
Again, I think there is a difference between the desired and realistic roles of an intelligence agency in disclosing exploits. Sure, I would hope they disclose them. But at the same time if they are actively using an exploit, I have pretty much no expectation of them disclosing it.
I think this has way more to do with our reference-point than anything else. My expectations were never quite as high!
In other words, you feel attempting to constrain the operations of intelligence agencies is equivalent of asking nicely, and that's the way is should be?
I mean the mentioned attempt was not as general as it was made out to be. Obama placed an exception for “a clear national security or law enforcement need”. Pretty much what my expectations were set at. Again I am reluctant to take anything that Wikileaks says as absolute truth, they love to spin.
From Wikileaks' overview:
"In the wake of Edward Snowden's leaks about the NSA, the U.S. technology industry secured a commitment from the Obama administration that the executive would disclose on an ongoing basis — rather than hoard — serious vulnerabilities, exploits, bugs or "zero days" to Apple, Google, Microsoft, and other US-based manufacturers. ... "Year Zero" documents show that the CIA breached the Obama administration's commitments. Many of the vulnerabilities used in the CIA's cyber arsenal are pervasive and some may already have been found by rival intelligence agencies or cyber criminals."
By not releasing this information to technology companies affected, they are increasing the risk of the same exploits being used against high profile US targets.