# Should the NSA be held responsible for the Wannacry ransomware attack? **URL:** \ **Category:** Great Debates\ **Created:** [May 15, 2017, 4:37am UTC](https://boards.straightdope.com/t/should-the-nsa-be-held-responsible-for-the-wannacry-ransomware-attack/786632 "2017-05-15T04:37:00Z")\ **Posts on this page:** 20\ **Page:** 2
**Author:** ![steronz](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/steronz/32/11765_2.png) [@steronz](https://boards.straightdope.com/u/steronz)\ **Post date:** [May 15, 2017, 4:23pm UTC](https://boards.straightdope.com/t/should-the-nsa-be-held-responsible-for-the-wannacry-ransomware-attack/786632/21 "2017-05-15T16:23:56Z")
> [@DrCube](#): > > Correct. Both of these organizations would rather cultivate their own power than actually serve the interests of the American people. That’s bureaucracy for you. Or they’ve decided that strategic enforcement serves the interests of the American people better. What about the FBI turning a blind eye to offenses of child pornography end users in order to bust the ringleaders? Surely there’s some example of a government agency seeing the forest that will meet your muster? ---
**Author:** ![wolfpup](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/wolfpup/32/10618_2.png) [@wolfpup](https://boards.straightdope.com/u/wolfpup)\ **Post date:** [May 15, 2017, 4:25pm UTC](https://boards.straightdope.com/t/should-the-nsa-be-held-responsible-for-the-wannacry-ransomware-attack/786632/22 "2017-05-15T16:25:50Z")
> [@Bricker](#): > > And who gets to define what constitutes ethical? You’ll find it in the dictionary. One definition of ethics is conforming to what is commonly considered acceptable and responsible behavior, which in the case of discovering vulnerabilities in common operating systems used by individuals, businesses, hospitals, and other institutions throughout the world is to notify the vendor and the major security organizations. Ethics may also dictate the need to limit, as necessary, public disclosure of the details to minimize the risks of an exploit. The serious failure in ethics and judgment here is that this was just a common everyday security flaw in Windows of the kind that are regularly found and patched in large numbers, so at best it was an exploit with a very limited lifetime, and at worst, it could have been independently discovered by hackers and caused a great deal of damage even if the NSA itself had not been hacked. This had all the wisdom of boys playing with dangerous toys and having something blow up in their faces, except that it blew up on thousands of blameless users including hospitals in numerous countries (it wasn’t just the British NHS). > [@Ravenman](#): > > For those who assert the NSA is negligent, let me ask a serious question. Do you think it should be government policy not to possess any zero-day exploits at all, for any reason? Like if we know that the Russian nuclear weapons system has a vulnerability in a commercial system that we could exploit to insure they could never launch a nuclear war, we should tell Microsoft (or whomever) to issue a patch? If a Russian nuclear weapons system is under the control of an off-the-shelf version of Windows riddled with security flaws and connected to the Internet, we’re all in deep trouble! And if the NSA’s secret access to such a facility depends on a common security flaw and the hope that Microsoft doesn’t get around to patching it or the Russians don’t buy a decent antivirus program, then I’d say we need a better security agency! > [@steronz](#): > > This isn’t some obscure notion that the NSA has never considered, though. Much like the allies famously allowed civilian deaths during WWII in order to conceal the fact that they had cracked German encryption, so too does the NSA allow government systems to remain vulnerable to preserve the power of its exploits. Whether or not to disclose a vulnerability is a decision they probably make thousands of times a year, and they know full well what the ramifications of not disclosing it are. That’s another failed analogy, in my view. Cracking the German encryption was a top-priority wartime initiative that was seen as a major key to victory and national survival, and involved some of the most intensive research and engineering effort of its kind in history conducted under unprecedented secrecy. It can hardly be compared to some kid finding a bug in Microsoft Windows. ---
**Author:** ![Happy\_Fun\_Ball](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/happy_fun_ball/32/17664_2.png) [@Happy\_Fun\_Ball](https://boards.straightdope.com/u/Happy_Fun_Ball)\ **Post date:** [May 15, 2017, 4:33pm UTC](https://boards.straightdope.com/t/should-the-nsa-be-held-responsible-for-the-wannacry-ransomware-attack/786632/23 "2017-05-15T16:33:38Z")
I believe the US government should take an active role in defending this nation’s cyber security, including the security of our businesses and public facilities. If a foreign power is able to damage our economy through cyber attacks, then our government has failed to protect us and has failed what many would agree is its primary function. Whether the NSA is the proper department to take on this role is another question, but I would argue that if by withholding this information they damaged the US security, they should be able to answer why they felt it necessary to leave the country vulnerable. ---
**Author:** ![Evan\_Drake](https://avatars.discourse-cdn.com/v4/letter/e/b487fb/32.png) [@Evan\_Drake](https://boards.straightdope.com/u/Evan_Drake)\ **Post date:** [May 15, 2017, 4:41pm UTC](https://boards.straightdope.com/t/should-the-nsa-be-held-responsible-for-the-wannacry-ransomware-attack/786632/24 "2017-05-15T16:41:57Z")
But you’re OK with their mission statement of _’ …and exploiting the foreign communications of adversaries_’, right ? ---
**Author:** ![Ravenman](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ravenman/32/2929_2.png) [@Ravenman](https://boards.straightdope.com/u/Ravenman)\ **Post date:** [May 15, 2017, 4:46pm UTC](https://boards.straightdope.com/t/should-the-nsa-be-held-responsible-for-the-wannacry-ransomware-attack/786632/25 "2017-05-15T16:46:04Z")
> [@wolfpup](#): > > If a Russian nuclear weapons system is under the control of an off-the-shelf version of Windows riddled with security flaws and connected to the Internet, we’re all in deep trouble! And if the NSA’s secret access to such a facility depends on a common security flaw and the hope that Microsoft doesn’t get around to patching it or the Russians don’t buy a decent antivirus program, then I’d say we need a better security agency! That isn’t a substantive answer; that’s a dodge. Once more: do you think that the US Government should possess no zero-day exploits, no matter what important systems the Government may hold at risk with them? Or if you think that the Government should hold only some zero-day exploits, what are some principles for what the Government should hold and what it should notify the public about? ETA: and although it doesn’t directly relate to this cyber threat, let’s not kid ourselves that nuclear command and control is a cutting edge set of systems that are constantly updated. [The US uses 8 inch floppy disks](http://www.npr.org/sections/thetwo-way/2016/05/26/479588478/report-u-s-nuclear-system-relies-on-outdated-technology-such-as-floppy-disks), and is probably not at risk because of the fact that it is so, so very outdated. ---
**Author:** ![steronz](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/steronz/32/11765_2.png) [@steronz](https://boards.straightdope.com/u/steronz)\ **Post date:** [May 15, 2017, 4:51pm UTC](https://boards.straightdope.com/t/should-the-nsa-be-held-responsible-for-the-wannacry-ransomware-attack/786632/26 "2017-05-15T16:51:05Z")
> [@wolfpup](#): > > That’s another failed analogy, in my view. Cracking the German encryption was a top-priority wartime initiative that was seen as a major key to victory and national survival, and involved some of the most intensive research and engineering effort of its kind in history conducted under unprecedented secrecy. It can hardly be compared to some kid finding a bug in Microsoft Windows. And a few hundred thousand ransomware attacks, while certainly harmful, isn’t quite the same as letting a city get razed by Nazi bombs and allowing thousands of civilians to die. I never said I was an analogy whiz. :):(😃 Point is, when the NSA sits on a zero day, they know the ramifications of that. While I appreciate that this ethical dilemma might be new to some audiences, [it’s](https://jia.sipa.columbia.edu/online-articles/healey_vulnerability_equities_process) [been](https://www.wired.com/2016/08/shadow-brokers-mess-happens-nsa-hoards-zero-days/) [covered](http://www.securityweek.com/zero-day-conundrum-keep-or-disclose-vulnerability-stockpiles). Like I said, barring some evidence of negligence or particularly bad risk assessment over this specific issue, I’m willing to give the NSA the benefit of the doubt. ---
**Author:** ![scr4](https://avatars.discourse-cdn.com/v4/letter/s/59ef9b/32.png) [@scr4](https://boards.straightdope.com/u/scr4)\ **Post date:** [May 15, 2017, 4:52pm UTC](https://boards.straightdope.com/t/should-the-nsa-be-held-responsible-for-the-wannacry-ransomware-attack/786632/27 "2017-05-15T16:52:29Z")
> [@Ravenman](#): > > For those who assert the NSA is negligent, let me ask a serious question. Do you think it should be government policy not to possess any zero-day exploits at all, for any reason? There’s always a chance that other governments will find the same exploit and use it to infiltrate systems in the US. Seems to me, the consequences of US systems being hacked can be much greater than any _lack_ of tools for the US to use. I might accept an exception if the exploit only worked on non-US computer systems (e.g. vulnerabilities specific to industrial systems not imported to the US). ---
**Author:** ![Slash1972](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/slash1972/32/6461_2.png) [@Slash1972](https://boards.straightdope.com/u/Slash1972)\ **Post date:** [May 15, 2017, 4:59pm UTC](https://boards.straightdope.com/t/should-the-nsa-be-held-responsible-for-the-wannacry-ransomware-attack/786632/28 "2017-05-15T16:59:45Z")
If I had to hazard a guess, I’d say when vulnerabilities such as this are found and/or brought to the NSA, they use a Risk-Management Process whereas they weigh the risks and advantages a given vulnerability has. A vulnerability that no one else knows about, without an exploit in the wild, would certainly be low risk. The advantages of it are self-evident. A determination is made whether to notify the vendor or not. When something changes, such as the release of the exploit as happened several months ago, a NEW determination is made. Coincidentally, the patch came out around then from the vendor. Blame a piss-poor vulnerability management program by the companies that were affected instead of the NSA. Of course, I’m just guessing. ---
**Author:** ![steronz](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/steronz/32/11765_2.png) [@steronz](https://boards.straightdope.com/u/steronz)\ **Post date:** [May 15, 2017, 5:02pm UTC](https://boards.straightdope.com/t/should-the-nsa-be-held-responsible-for-the-wannacry-ransomware-attack/786632/29 "2017-05-15T17:02:09Z")
> [@scr4](#): > > There’s always a chance that other governments will find the same exploit and use it to infiltrate systems in the US. Seems to me, the consequences of US systems being hacked can be much greater than any _lack_ of tools for the US to use. I might accept an exception if the exploit only worked on non-US computer systems (e.g. vulnerabilities specific to industrial systems not imported to the US). What about a hypothetical exploit used to gain access to an ISIS lieutenant’s computer, which results in actionable intelligence about an impending attack on a friendly target? You’d prefer they release that vulnerability and give ISIS a chance to patch their computer? ---
**Author:** ![Ravenman](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ravenman/32/2929_2.png) [@Ravenman](https://boards.straightdope.com/u/Ravenman)\ **Post date:** [May 15, 2017, 5:08pm UTC](https://boards.straightdope.com/t/should-the-nsa-be-held-responsible-for-the-wannacry-ransomware-attack/786632/30 "2017-05-15T17:08:50Z")
> [@scr4](#): > > There’s always a chance that other governments will find the same exploit and use it to infiltrate systems in the US. Seems to me, the consequences of US systems being hacked can be much greater than any _lack_ of tools for the US to use. I might accept an exception if the exploit only worked on non-US computer systems (e.g. vulnerabilities specific to industrial systems not imported to the US). How comfortable are you with this position since we, as members of the public, are in a poor position to judge the pros and cons of the NSA never maintaining zero-days for widely available commercial computer systems? You’ve highlighted one “pro” for such a policy, but do you feel you have a good handle on what the “cons” are for that question? ---
**Author:** ![wolfpup](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/wolfpup/32/10618_2.png) [@wolfpup](https://boards.straightdope.com/u/wolfpup)\ **Post date:** [May 15, 2017, 5:41pm UTC](https://boards.straightdope.com/t/should-the-nsa-be-held-responsible-for-the-wannacry-ransomware-attack/786632/31 "2017-05-15T17:41:13Z")
> [@Ravenman](#): > > That isn’t a substantive answer; that’s a dodge. Once more: do you think that the US Government should possess no zero-day exploits, no matter what important systems the Government may hold at risk with them? > > Or if you think that the Government should hold only some zero-day exploits, what are some principles for what the Government should hold and what it should notify the public about? It wasn’t a dodge, it was a direct answer. I’ll state it in different terms. A zero-day exploit in a common and widespread operating system is not likely to stay zero-day (i.e.- unknown to the public) for very long. The only question is what will happen first, its discovery by _ **ethical** _ agencies who provide fixes and protections, or its discovery by hackers who wreak havoc. It is, therefore, a very poor tool because it is both likely to be short-lived and potentially risky. It’s just an odd happenstance that it made it into the wild due to the NSA itself being hacked; it was more likely – and foreseeable – that it would have been independently discovered by hackers. > [@steronz](#): > > Point is, when the NSA sits on a zero day, they know the ramifications of that. While I appreciate that this ethical dilemma might be new to some audiences, [it’s](https://jia.sipa.columbia.edu/online-articles/healey_vulnerability_equities_process) [been](https://www.wired.com/2016/08/shadow-brokers-mess-happens-nsa-hoards-zero-days/) [covered](http://www.securityweek.com/zero-day-conundrum-keep-or-disclose-vulnerability-stockpiles). Like I said, barring some evidence of negligence or particularly bad risk assessment over this specific issue, I’m willing to give the NSA the benefit of the doubt. I’m not, for the reason given above – it was very poor judgment. Kind of like defending yourself with a stick of dynamite that will become inert and useless in a short time but meanwhile is so unstable that it might spontaneously blow up in your hand. Not really a great weapon. ---
**Author:** ![scr4](https://avatars.discourse-cdn.com/v4/letter/s/59ef9b/32.png) [@scr4](https://boards.straightdope.com/u/scr4)\ **Post date:** [May 15, 2017, 5:56pm UTC](https://boards.straightdope.com/t/should-the-nsa-be-held-responsible-for-the-wannacry-ransomware-attack/786632/32 "2017-05-15T17:56:42Z")
> [@Ravenman](#): > > How comfortable are you with this position since we, as members of the public, are in a poor position to judge the pros and cons of the NSA never maintaining zero-days for widely available commercial computer systems? You’ve highlighted one “pro” for such a policy, but do you feel you have a good handle on what the “cons” are for that question? It’s not just a simple risk vs. benefit calculus, it’s a moral issue. Putting our own people at risk should not be an acceptable trade-off for maintaining an offensive capability. It would be like waiving worker safety rules to build a new weapon for war. ---
**Author:** ![Ravenman](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ravenman/32/2929_2.png) [@Ravenman](https://boards.straightdope.com/u/Ravenman)\ **Post date:** [May 15, 2017, 6:04pm UTC](https://boards.straightdope.com/t/should-the-nsa-be-held-responsible-for-the-wannacry-ransomware-attack/786632/33 "2017-05-15T18:04:12Z")
> [@wolfpup](#): > > It wasn’t a dodge, it was a direct answer. I’ll state it in different terms. A zero-day exploit in a common and widespread operating system **is not likely to stay zero-day (i.e.- unknown to the public) for very long**. The only question is what will happen first, its discovery by _ **ethical** _ agencies who provide fixes and protections, or its discovery by hackers who wreak havoc. It is, therefore, a very poor tool because it is both **likely to be short-lived** and potentially risky. It’s just an odd happenstance that it made it into the wild due to the NSA itself being hacked; it was more likely – and foreseeable – that it would have been independently discovered by hackers. This doesn’t make any sense. You’re arguing against your own case. I find it totally inconsistent to say in this case that zero-days are both short-lived and risky, implying that something is both dangerous and useless at the same time. As a general proposition, if it is useless, then few computers would be vulnerable to it over a short period of time. If it is risky, then many computers would be vulnerable to it over a longer period of time. In this case, we can generally agree that this exploit was risky. But then your implication that the NSA would not find value in it is shown to be wrong: it IS successful in infecting computers, showing that it is “useful.” So which is it? You sort of have to pick a horse to ride on, because your two horses are headed in opposite directions. ---
**Author:** ![steronz](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/steronz/32/11765_2.png) [@steronz](https://boards.straightdope.com/u/steronz)\ **Post date:** [May 15, 2017, 6:15pm UTC](https://boards.straightdope.com/t/should-the-nsa-be-held-responsible-for-the-wannacry-ransomware-attack/786632/34 "2017-05-15T18:15:16Z")
> [@scr4](#): > > It’s not just a simple risk vs. benefit calculus, it’s a moral issue. Putting our own people at risk should not be an acceptable trade-off for maintaining an offensive capability. It would be like waiving worker safety rules to build a new weapon for war. What about a defensive capability? What if one of these secret zero-days could have been used to prevent 9/11? ---
**Author:** ![Ravenman](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ravenman/32/2929_2.png) [@Ravenman](https://boards.straightdope.com/u/Ravenman)\ **Post date:** [May 15, 2017, 6:15pm UTC](https://boards.straightdope.com/t/should-the-nsa-be-held-responsible-for-the-wannacry-ransomware-attack/786632/35 "2017-05-15T18:15:37Z")
> [@scr4](#): > > It’s not just a simple risk vs. benefit calculus, it’s a moral issue. Putting our own people at risk should not be an acceptable trade-off for maintaining an offensive capability. It would be like waiving worker safety rules to build a new weapon for war. So go back to my extreme case: the US Government can foil a Russian nuclear weapons launch because of a flaw in Windows. If the Government keeps it secret, then it is much more likely that 75,000 computers in dozens of countries could be held for $300 ransom. If the Government does not keep it a secret, then there’s a small fraction of a smurfs-ass-hair of a chance that hundreds of millions of Americans would die in a nuclear war. To claim that this is a simple moral question is not clear to me at all. Which risk should we take more seriously: the relatively high odds that a very small percentage of the many hundreds of millions of Windows computers in the world will be ransomed, perhaps with risks to the lives of relatively small numbers of people who may be in hospitals; or the remote chance that if nuclear war were to break out, that we could save many hundreds of millions of lives? I think that’s a pretty fucking hard question to answer, in terms of responsibility to the security of people in this country and elsewhere. ---
**Author:** ![puzzlegal](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/puzzlegal/32/3827_2.png) [@puzzlegal](https://boards.straightdope.com/u/puzzlegal)\ **Post date:** [May 15, 2017, 6:37pm UTC](https://boards.straightdope.com/t/should-the-nsa-be-held-responsible-for-the-wannacry-ransomware-attack/786632/36 "2017-05-15T18:37:03Z")
> [@AlsoNamedBort](#): > > Is there a timeline of when the NSA discovered this and when it was stolen? My understanding is that Microsoft patched this in Windows 7 a couple months ago, but the systems affected were either not updated or still running XP which hasn’t been supported in years. This. While the questions asked in this thread are all reasonable, in this particular case, Microsoft knew about the bug and fixed it and issued a patch months before this malware was released. The problem is that many people and institutions are slow to upgrade. Now, is the NSA liable for creating this malware and then losing it? If it were a private party that had done this, I think they would be liable. The government enjoys broad immunity from lawsuits, but can still be morally liable, of course. The “someone stole my loaded gun” analogy seems apt. Did they take reasonable precautions to avoid that? ---
**Author:** ![scr4](https://avatars.discourse-cdn.com/v4/letter/s/59ef9b/32.png) [@scr4](https://boards.straightdope.com/u/scr4)\ **Post date:** [May 15, 2017, 7:42pm UTC](https://boards.straightdope.com/t/should-the-nsa-be-held-responsible-for-the-wannacry-ransomware-attack/786632/37 "2017-05-15T19:42:54Z")
> [@Ravenman](#): > > So go back to my extreme case: the US Government can foil a Russian nuclear weapons launch because of a flaw in Windows. If the Government keeps it secret, then it is much more likely that 75,000 computers in dozens of countries could be held for $300 ransom. If the Government does not keep it a secret, then there’s a small fraction of a smurfs-ass-hair of a chance that hundreds of millions of Americans would die in a nuclear war. That is a ridiculous example. There are many, many levels of protection against a Russian nuclear attack, from basic diplomacy & international treaties to mutual assured destruction and missile defense systems. We got through the Cold War without either side having to sabotage the other’s offensive capabilities. And if all those layers of protection fail, to the point where an NSA hack is all that’s standing in the way of a global thermonuclear war, then the situation is already hopeless. In fact, if a Russian nuclear weapons system has a software vulnerability, the more significant danger is for someone to infiltrate it and _activate_ the weapon. It’s in our best interest to make sure their systems are secure. ---
**Author:** ![Ravenman](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ravenman/32/2929_2.png) [@Ravenman](https://boards.straightdope.com/u/Ravenman)\ **Post date:** [May 15, 2017, 7:50pm UTC](https://boards.straightdope.com/t/should-the-nsa-be-held-responsible-for-the-wannacry-ransomware-attack/786632/38 "2017-05-15T19:50:09Z")
> [@scr4](#): > > That is a ridiculous example. There are many, many levels of protection against a Russian nuclear attack, from basic diplomacy & international treaties to mutual assured destruction and missile defense systems. We got through the Cold War without either side having to sabotage the other’s offensive capabilities. And if all those layers of protection fail, to the point where an NSA hack is all that’s standing in the way of a global thermonuclear war, then the situation is already hopeless. > > In fact, if a Russian nuclear weapons system has a software vulnerability, the more significant danger is for someone to infiltrate it and _activate_ the weapon. It’s in our best interest to make sure their systems are secure. Okay, fight the hypothetical. I guess this is what passes for debate on moral questions around here these days. ---
**Author:** ![scr4](https://avatars.discourse-cdn.com/v4/letter/s/59ef9b/32.png) [@scr4](https://boards.straightdope.com/u/scr4)\ **Post date:** [May 15, 2017, 7:54pm UTC](https://boards.straightdope.com/t/should-the-nsa-be-held-responsible-for-the-wannacry-ransomware-attack/786632/39 "2017-05-15T19:54:52Z")
> [@Ravenman](#): > > Okay, fight the hypothetical. I guess this is what passes for debate on moral questions around here these days. It’s not a hypothetical that there are numerous protections against a nuclear war. The scenario _you_ suggested is the hypothetical. ---
**Author:** ![Ravenman](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ravenman/32/2929_2.png) [@Ravenman](https://boards.straightdope.com/u/Ravenman)\ **Post date:** [May 15, 2017, 8:00pm UTC](https://boards.straightdope.com/t/should-the-nsa-be-held-responsible-for-the-wannacry-ransomware-attack/786632/40 "2017-05-15T20:00:03Z")
> [@scr4](#): > > The scenario _you_ suggested is the hypothetical. YES! Yes! A thousand times, yes! It’s a hypothetical. And I’ve told you it is an extreme. And you keep fighting it. [Previous page](https://boards.straightdope.com/t/should-the-nsa-be-held-responsible-for-the-wannacry-ransomware-attack/786632.md?page=1) [Next page](https://boards.straightdope.com/t/should-the-nsa-be-held-responsible-for-the-wannacry-ransomware-attack/786632.md?page=3)