Should U.S. Hackers Fix Cybersecurity Holes or Exploit Them?

There’s a debate going on about whether the U.S. government—specifically, the NSA and United States Cyber Command—should stockpile Internet vulnerabilities or disclose and fix them. It's a complicated problem, and one that starkly illustrates the difficulty of separating attack and defense in cyberspace.

A software vulnerability is a programming mistake that allows an adversary access into that system. Heartbleed is a recent example, but hundreds are discovered every year.

Unpublished vulnerabilities are called “zero-day” vulnerabilities, and they’re very valuable because no one is protected. Someone with one of those can attack systems world-wide with impunity.

When someone discovers one, he can either use it for defense or for offense. Defense means alerting the vendor and getting it patched.  Lots of vulnerabilities are discovered by the vendors themselves and patched without any fanfare.  Others are discovered by researchers and hackers.  A patch doesn’t make the vulnerability go away, but most users protect themselves by patch their systems regularly.

Offense means using