# Should the NSA be held responsible for the Wannacry ransomware attack? **URL:** \ **Category:** Great Debates\ **Created:** [May 15, 2017, 4:37am UTC](https://boards.straightdope.com/t/should-the-nsa-be-held-responsible-for-the-wannacry-ransomware-attack/786632 "2017-05-15T04:37:00Z")\ **Posts on this page:** 20\ **Page:** 3
**Author:** ![scr4](https://avatars.discourse-cdn.com/v4/letter/s/59ef9b/32.png) [@scr4](https://boards.straightdope.com/u/scr4)\ **Post date:** [May 15, 2017, 8:01pm UTC](https://boards.straightdope.com/t/should-the-nsa-be-held-responsible-for-the-wannacry-ransomware-attack/786632/41 "2017-05-15T20:01:46Z")
> [@steronz](#): > > What about a defensive capability? What if one of these secret zero-days could have been used to prevent 9/11? Not everything that “could have been used to 9/11” is allowable. We’ve already allowed so many violations of privacy and civil rights using that excuse. ---
**Author:** ![scr4](https://avatars.discourse-cdn.com/v4/letter/s/59ef9b/32.png) [@scr4](https://boards.straightdope.com/u/scr4)\ **Post date:** [May 15, 2017, 8:04pm UTC](https://boards.straightdope.com/t/should-the-nsa-be-held-responsible-for-the-wannacry-ransomware-attack/786632/42 "2017-05-15T20:04:06Z")
> [@Ravenman](#): > > YES! Yes! A thousand times, yes! It’s a hypothetical. And I’ve told you it is an extreme. And you keep fighting it. Yes, you posited a hypothetical, I explained why I think your hypothetical is flawed. What’s the problem with that? ---
**Author:** ![Ravenman](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ravenman/32/2929_2.png) [@Ravenman](https://boards.straightdope.com/u/Ravenman)\ **Post date:** [May 15, 2017, 8:09pm UTC](https://boards.straightdope.com/t/should-the-nsa-be-held-responsible-for-the-wannacry-ransomware-attack/786632/43 "2017-05-15T20:09:31Z")
> [@scr4](#): > > Yes, you posited a hypothetical, I explained why I think your hypothetical is flawed. What’s the problem with that? The entire purpose of hypothetical scenarios is to test responses to unusual circumstances. Pointing out that the scenario is unusual sheds no light on the subject. Have you ever played the game, “Would you rather?” For example, would you rather have sex with the most disgusting person you know, but nobody will believe that you did; or would you rather NOT have sex with the most disgusting person you know, but everybody would think you did? Pointing out that both scenarios are outlandish does nothing to further the conversation. ---
**Author:** ![Bricker](https://avatars.discourse-cdn.com/v4/letter/b/977dab/32.png) [@Bricker](https://boards.straightdope.com/u/Bricker)\ **Post date:** [May 15, 2017, 8:16pm UTC](https://boards.straightdope.com/t/should-the-nsa-be-held-responsible-for-the-wannacry-ransomware-attack/786632/44 "2017-05-15T20:16:03Z")
> [@wolfpup](#): > > You’ll find it in the dictionary. One definition of ethics is conforming to what is commonly considered acceptable and responsible behavior, which in the case of discovering vulnerabilities in common operating systems used by individuals, businesses, hospitals, and other institutions throughout the world is to notify the vendor and the major security organizations. Ethics may also dictate the need to limit, as necessary, public disclosure of the details to minimize the risks of an exploit. > . > . > . > That’s another failed analogy, in my view. Cracking the German encryption was a top-priority wartime initiative that was seen as a major key to victory and national survival, and involved some of the most intensive research and engineering effort of its kind in history conducted under unprecedented secrecy. It can hardly be compared to some kid finding a bug in Microsoft Windows. It certainly cannot. And neither can this exploit: despite SMBv1 being in use since before the year 2000, and explored by countless millions of kids since then, this exploit was discovered by the public only after the NSA leak…hardly the inevitable discovery one might have pictured from reading your words. So I’ll dispose of your “dictionary” claim the same way: nuh-uh. ---
**Author:** ![scr4](https://avatars.discourse-cdn.com/v4/letter/s/59ef9b/32.png) [@scr4](https://boards.straightdope.com/u/scr4)\ **Post date:** [May 15, 2017, 8:29pm UTC](https://boards.straightdope.com/t/should-the-nsa-be-held-responsible-for-the-wannacry-ransomware-attack/786632/45 "2017-05-15T20:29:32Z")
> [@Ravenman](#): > > The entire purpose of hypothetical scenarios is to test responses to unusual circumstances. Pointing out that the scenario is unusual sheds no light on the subject. Maybe I misunderstood your position. Are you saying the NSA should not disclose zero-day exploits because it might, at a later date, turn out to be useful for preventing a nuclear attack? Or are you saying, if the NSA already knew that a Russian nuclear missile system had a specific vulnerability, then they are entitled to make an exception and keep _that one vulnerability_ a secret? I was assuming the former, and my response is that it is not a good enough reason because such situations are highly unlikely. If the latter, that would be more debatable. Or using the 9/11 example, if the NSA was already tracking a terrorist cell using a zero-day exploit, I could see them being very reluctant to disclose that exploit. Nevertheless, they need to be weighed against the risks of Russia/China/etc using the same exploit to steal classified information from US agencies, defense contractors, etc. At the very least, I don’t think the NSA can be trusted to be impartial in this judgment. ---
**Author:** ![Ravenman](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ravenman/32/2929_2.png) [@Ravenman](https://boards.straightdope.com/u/Ravenman)\ **Post date:** [May 15, 2017, 8:42pm UTC](https://boards.straightdope.com/t/should-the-nsa-be-held-responsible-for-the-wannacry-ransomware-attack/786632/46 "2017-05-15T20:42:13Z")
> [@scr4](#): > > Maybe I misunderstood your position. Are you saying the NSA should not disclose zero-day exploits because it might, at a later date, turn out to be useful for preventing a nuclear attack? Or are you saying, if the NSA already knew that a Russian nuclear missile system had a specific vulnerability, then they are entitled to make an exception and keep _that one vulnerability_ a secret? Let me rephrase the question: are there ANY circumstances in which you could see a legitimate case for the NSA not disclosing a zero-day that it knows about? If there are such circumstances that you can imagine, how would you set a policy of what zero-days to hoard for later use, and which ones to make public? ---
**Author:** ![Rysto](https://avatars.discourse-cdn.com/v4/letter/r/ecccb3/32.png) [@Rysto](https://boards.straightdope.com/u/Rysto)\ **Post date:** [May 15, 2017, 8:51pm UTC](https://boards.straightdope.com/t/should-the-nsa-be-held-responsible-for-the-wannacry-ransomware-attack/786632/47 "2017-05-15T20:51:24Z")
I’m not sure that the NSA disclosing the vulnerability to Microsoft earlier would have helped very much. Microsoft would have issued a patch sooner, but once Microsoft issues a patch, malware writers can decompile it to reverse-engineer the original security issue, and then write malware to target it. Because so many people fail to update their systems, this is a very effective way of finding vulnerabilities for malware writers. ---
**Author:** ![Bricker](https://avatars.discourse-cdn.com/v4/letter/b/977dab/32.png) [@Bricker](https://boards.straightdope.com/u/Bricker)\ **Post date:** [May 15, 2017, 9:28pm UTC](https://boards.straightdope.com/t/should-the-nsa-be-held-responsible-for-the-wannacry-ransomware-attack/786632/48 "2017-05-15T21:28:41Z")
> [@Rysto](#): > > I’m not sure that the NSA disclosing the vulnerability to Microsoft earlier would have helped very much. Microsoft would have issued a patch sooner, but once Microsoft issues a patch, malware writers can decompile it to reverse-engineer the original security issue, and then write malware to target it. Because so many people fail to update their systems, this is a very effective way of finding vulnerabilities for malware writers. In this case, though, not necessarily. The patch could simply disable SMBv1 without exposing why it’s vulnerable. ---
**Author:** ![steronz](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/steronz/32/11765_2.png) [@steronz](https://boards.straightdope.com/u/steronz)\ **Post date:** [May 15, 2017, 9:36pm UTC](https://boards.straightdope.com/t/should-the-nsa-be-held-responsible-for-the-wannacry-ransomware-attack/786632/49 "2017-05-15T21:36:16Z")
> [@Bricker](#): > > In this case, though, not necessarily. The patch could simply disable SMBv1 without exposing why it’s vulnerable. There’s still stuff that uses SMB1, apparently. I don’t think MS could push out an automatic update that disabled it without pissing off a lot of people. ---
**Author:** ![wolfpup](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/wolfpup/32/10618_2.png) [@wolfpup](https://boards.straightdope.com/u/wolfpup)\ **Post date:** [May 15, 2017, 10:44pm UTC](https://boards.straightdope.com/t/should-the-nsa-be-held-responsible-for-the-wannacry-ransomware-attack/786632/50 "2017-05-15T22:44:00Z")
> [@Ravenman](#): > > This doesn’t make any sense. You’re arguing against your own case. > > I find it totally inconsistent to say in this case that zero-days are both short-lived and risky, implying that something is both dangerous and useless at the same time. > > As a general proposition, if it is useless, then few computers would be vulnerable to it over a short period of time. If it is risky, then many computers would be vulnerable to it over a longer period of time. > > In this case, we can generally agree that this exploit was risky. But then your implication that the NSA would not find value in it is shown to be wrong: it IS successful in infecting computers, showing that it is “useful.” > > So which is it? You sort of have to pick a horse to ride on, because your two horses are headed in opposite directions. You seem to be trying really hard to find a contradiction where there isn’t one. There’s nothing contradictory about something being both short-lived and risky, as in my example of an explosive that is very unstable for a while and then goes inert. I never used the words “dangerous” and “useless” but if you want to put that interpretation on it, that works, too: if the average person found a large bottle of pure nitroglycerine in their basement, that would be both dangerous and useless to them, and I’m sure they would thank the bomb squad for safely taking it away. Putting the analogies aside, “short-lived” means an exploit is likely to have a finite and probably quite a short lifetime, often measured in months or even weeks before it’s patched; “risky” means it still has lots of opportunity to cause huge amounts of damage – this particular virus seemed to get deployed all over the world within hours – and that it’s incredibly irresponsible to just leave it to chance whether a hacker might discover it before security people do, and to use as one’s justification the off-chance that maybe you might have a chance to use it as a spy tool before it’s fixed. > [@Bricker](#): > > It certainly cannot. And neither can this exploit: despite SMBv1 being in use since before the year 2000, and explored by countless millions of kids since then, this exploit was discovered by the public only after the NSA leak…hardly the inevitable discovery one might have pictured from reading your words. > > So I’ll dispose of your “dictionary” claim the same way: nuh-uh. I don’t know that this exploit was based on any particular iteration of the SMB architecture – I thought it was a Microsoft implementation issue (I could be wrong, though). SMB goes back at least a decade before 2000, and has numerous other implementations besides Windows (Samba, NQ, etc.). Windows is the only one being talked about, and after the patch, SMB still works of course, just not with the vulnerability – all of which supports the premise that it’s a Microsoft implementation issue. In fact I just connected my newly patched Windows system to an old Unix/Samba system – works fine. That said, its existence back to at least Windows XP does confirm that the vulnerability has been around a long time. Most vulnerabilities are quite short-lived, this one appears to have been around longer, but not necessarily for any reason other than chance. Microsoft issued 495 critical security updates to Windows 7 _ **after** _ the major rollup in SP1 – I can only imagine how many there were in total, especially if you include its predecessor, Vista. Lots of stuff gets found, a few things linger longer than most. Is there some reason to believe this was an exceptionally difficult or ingenious exploit? Either way, the point about ethics remains. It was unethical to risk letting this get out into the wild either by leak or by chance discovery. ---
**Author:** ![igor\_frankensteen](https://avatars.discourse-cdn.com/v4/letter/i/839c29/32.png) [@igor\_frankensteen](https://boards.straightdope.com/u/igor_frankensteen)\ **Post date:** [May 15, 2017, 11:04pm UTC](https://boards.straightdope.com/t/should-the-nsa-be-held-responsible-for-the-wannacry-ransomware-attack/786632/51 "2017-05-15T23:04:25Z")
> [@](#): > > Should the NSA be held responsible for the Wannacry ransomware attack? No. Regardless. The attack was created by modifying stolen NSA software and information. The legal precedent of holding an entity responsible for what a criminal does with other peoples/ products would cripple more industries, educational systems and other elements of our civilisation than can be listed here. ---
**Author:** ![Bricker](https://avatars.discourse-cdn.com/v4/letter/b/977dab/32.png) [@Bricker](https://boards.straightdope.com/u/Bricker)\ **Post date:** [May 15, 2017, 11:52pm UTC](https://boards.straightdope.com/t/should-the-nsa-be-held-responsible-for-the-wannacry-ransomware-attack/786632/52 "2017-05-15T23:52:12Z")
> [@wolfpup](#): > > I don’t know that this exploit was based on any particular iteration of the SMB architecture – I thought it was a Microsoft implementation issue (I could be wrong, though). It is a Microsoft implementation: of SMBv1. See CVE-2017-0144. > [@](#): > > In fact I just connected my newly patched Windows system to an old Unix/Samba system – works fine. Sure: the patch fixes SMBv1. But disabling SMBv1 (HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters, add a DWORD parameter called SMB1 with value 0x0 ) also works. Obivously better to patch because then you retain backwards compatinility with really old non-Windows SMBv1 installs. > [@](#): > > Either way, the point about ethics remains. It was unethical to risk letting this get out into the wild either by leak or by chance discovery. Nun uh. No way. It was perfectly ethical. ---
**Author:** ![up\_the\_junction](https://avatars.discourse-cdn.com/v4/letter/u/f1d935/32.png) [@up\_the\_junction](https://boards.straightdope.com/u/up_the_junction)\ **Post date:** [May 15, 2017, 11:59pm UTC](https://boards.straightdope.com/t/should-the-nsa-be-held-responsible-for-the-wannacry-ransomware-attack/786632/53 "2017-05-15T23:59:12Z")
It reminds me of 24 Days Later, the plot of which is … leftie types break into Gov facility where experiments on animals inc. nasty viruses. Nasty virus escapes and humanity (or at least Britain) is devastated. Sure you blame the clueless lefities but who created the damn virus and didn’t protect it even close to responsibly ---
**Author:** ![tim314](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/tim314/32/3468_2.png) [@tim314](https://boards.straightdope.com/u/tim314)\ **Post date:** [May 16, 2017, 12:00am UTC](https://boards.straightdope.com/t/should-the-nsa-be-held-responsible-for-the-wannacry-ransomware-attack/786632/54 "2017-05-16T00:00:16Z")
> [@Bricker](#): > > And who gets to define what constitutes ethical? We all do, as a society. We won’t all reach the same conclusion, but so what? Is it your position that no one has any obligation to be ethical until we can reach unanimity on the definition of “ethical”? The OP seems to be suggesting that the NSA should suffer the condemnation of the public or of the media. (“I haven’t really heard anyone screaming that the NSA did wrong”.) The poster to whom you replied appears to be responding in the affirmative, because in his view the NSA had a duty to behave ethically and they failed to do so. Whether this is true or not depends in part on the question of what is or isn’t ethical behavior, but it doesn’t require that someone “gets to define what constitutes ethical”. By analogy, “Oh yeah, sez who?” wouldn’t be a pertinent reply to my claim that “murder is morally wrong”, unless I’m actually basing the claim on an appeal to some authority. ---
**Author:** ![Bricker](https://avatars.discourse-cdn.com/v4/letter/b/977dab/32.png) [@Bricker](https://boards.straightdope.com/u/Bricker)\ **Post date:** [May 16, 2017, 12:36am UTC](https://boards.straightdope.com/t/should-the-nsa-be-held-responsible-for-the-wannacry-ransomware-attack/786632/55 "2017-05-16T00:36:17Z")
> [@tim314](#): > > We all do, as a society. We won’t all reach the same conclusion, but so what? Is it your position that no one has any obligation to be ethical until we can reach unanimity on the definition of “ethical”? When there is less than near-unanimity, then it seems to me the argument ought to be less about certainty and more about argument. > [@](#): > > Whether this is true or not depends in part on the question of what is or isn’t ethical behavior, but it doesn’t require that someone “gets to define what constitutes ethical”. > > By analogy, “Oh yeah, sez who?” wouldn’t be a pertinent reply to my claim that “murder is morally wrong”, unless I’m actually basing the claim on an appeal to some authority. Because you’re correct in assuming a near-universal agreement that murder is morally wrong. But a similar confident declaration from me that abortion is morally wrong would absolutely earn rebuttals similar in spirit to “Sez who?” Right? ---
**Author:** ![Evan\_Drake](https://avatars.discourse-cdn.com/v4/letter/e/b487fb/32.png) [@Evan\_Drake](https://boards.straightdope.com/u/Evan_Drake)\ **Post date:** [May 16, 2017, 2:22am UTC](https://boards.straightdope.com/t/should-the-nsa-be-held-responsible-for-the-wannacry-ransomware-attack/786632/56 "2017-05-16T02:22:51Z")
> [@Bricker](#): > > Because you’re correct in assuming a near-universal agreement that murder is morally wrong. Not really, apart from the fact there were places in 19th century London, Paris and New York where a midnight stroll would ensure one was never seen again, or that in Mao’s Republic millions died for utterly trivial reasons, in an earlier culture, the Roman Republic, a Citizen could kill practically any non-Roman Citizen practically at will. Including his own family. One choleric fellow fed an unsatisfactory slave alive to the eels in his fishpond without it leading to his being cut in public by the best families. ---
**Author:** ![Happy\_Fun\_Ball](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/happy_fun_ball/32/17664_2.png) [@Happy\_Fun\_Ball](https://boards.straightdope.com/u/Happy_Fun_Ball)\ **Post date:** [May 16, 2017, 2:38am UTC](https://boards.straightdope.com/t/should-the-nsa-be-held-responsible-for-the-wannacry-ransomware-attack/786632/57 "2017-05-16T02:38:39Z")
> [@Evan\_Drake](#): > > But you’re OK with their mission statement of _’ …and exploiting the foreign communications of adversaries_’, right ? Where is this mission statement posted? It is hard to give an opinion without reading the entire thing in context. That said, I am OK with my government exploiting foreign resources if their goal is to protect me and mine. I don’t think they should exploit for gain, neither gain for themselves nor for US citizens, but protecting us is their mission and the line they shouldn’t cross moves with the threat. > [@Ravenman](#): > > That isn’t a substantive answer; that’s a dodge. Once more: do you think that the US Government should possess no zero-day exploits, no matter what important systems the Government may hold at risk with them? > > Or if you think that the Government should hold only some zero-day exploits, what are some principles for what the Government should hold and what it should notify the public about? If the government holds a zero-day exploit, their primary goal should be to protect US citizens from it. If they can do this by working with Microsoft (or whoever) to roll out the patch quickly in the event that it is exploited by adversaries, but in the meantime they will exploit it against our adversaries, then all is right with the world. To sit on the exploit and not take any steps at defending our interests in this regard is criminal in my opinion. I am not saying that this was the case here. > [@puzzlegal](#): > > This. > > While the questions asked in this thread are all reasonable, in this particular case, Microsoft knew about the bug and fixed it and issued a patch months before this malware was released. The problem is that many people and institutions are slow to upgrade. > > Now, is the NSA liable for creating this malware and then losing it? If it were a private party that had done this, I think they would be liable. The government enjoys broad immunity from lawsuits, but can still be morally liable, of course. The “someone stole my loaded gun” analogy seems apt. Did they take reasonable precautions to avoid that? And this is why the answer to the thread is no. ---
**Author:** ![Evan\_Drake](https://avatars.discourse-cdn.com/v4/letter/e/b487fb/32.png) [@Evan\_Drake](https://boards.straightdope.com/u/Evan_Drake)\ **Post date:** [May 16, 2017, 2:44am UTC](https://boards.straightdope.com/t/should-the-nsa-be-held-responsible-for-the-wannacry-ransomware-attack/786632/58 "2017-05-16T02:44:43Z")
> [@Happy\_Fun\_Ball](#): > > Where is this mission statement posted? It is hard to give an opinion without reading the entire thing in context. That said, I am OK with my government exploiting foreign resources if their goal is to protect me and mine. I don’t think they should exploit for gain, neither gain for themselves nor for US citizens, but protecting us is their mission and the line they shouldn’t cross moves with the threat. > . In Post No. 6. ---
**Author:** ![Happy\_Fun\_Ball](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/happy_fun_ball/32/17664_2.png) [@Happy\_Fun\_Ball](https://boards.straightdope.com/u/Happy_Fun_Ball)\ **Post date:** [May 16, 2017, 3:46am UTC](https://boards.straightdope.com/t/should-the-nsa-be-held-responsible-for-the-wannacry-ransomware-attack/786632/59 "2017-05-16T03:46:33Z")
> [@Evan\_Drake](#): > > In Post No. 6. Wait, a doper finds a “sketch cache” that _seems_ to show that their values are (used to be?) “exploiting the foreign communications of adversaries” and you are asking me if I am OK with it? Where is this “sketch cache?” Anybody have a link? Why should I even believe that the cache has anything to do with the NSA and their official mission statement? ---
**Author:** ![Ruken](https://avatars.discourse-cdn.com/v4/letter/r/f475e1/32.png) [@Ruken](https://boards.straightdope.com/u/Ruken)\ **Post date:** [May 16, 2017, 11:47am UTC](https://boards.straightdope.com/t/should-the-nsa-be-held-responsible-for-the-wannacry-ransomware-attack/786632/60 "2017-05-16T11:47:23Z")
> [@Tastes\_of\_Chocolate](#): > > Should the NSA be held responsible for trying to keep this security weakness a secret, so that they might be able to exploit it to their own benefit? I’m hoping for some clarification here because I don’t really understand what is meant by “held responsible” in this case. [Previous page](https://boards.straightdope.com/t/should-the-nsa-be-held-responsible-for-the-wannacry-ransomware-attack/786632.md?page=2) [Next page](https://boards.straightdope.com/t/should-the-nsa-be-held-responsible-for-the-wannacry-ransomware-attack/786632.md?page=4)