For decades governments have weakened computer security to catch criminals, and the bugs they hoard or leave behind are open to anyone who finds them.
Security people have an old saying: you cannot make users more secure by making their computers less secure. It sounds like a platitude, yet governments keep breaking it.
Hoarding Bugs Comes Back to Bite
US intelligence agencies run on a doctrine called NOBUS, short for 'no one but us': only we are clever enough to find this bug. So they sit on it, tell no vendor, and keep it for use against enemies.
But hoarded bugs keep leaking. Eternal Blue, a Windows flaw the NSA had kept quiet, leaked in 2017 and was quickly fused with ransomware into WannaCry, which hit hospitals, banks, oil pipelines and Baltimore's city government.
A Backdoor Installed in Your Computer
German customs officers secretly installed a government-bought surveillance trojan on travellers' computers at border checks. It could grab screens, rifle through hard drives and run software remotely. Worse, it was itself insecure, so anyone could scan the internet and take those machines over.
The EU's 'chat control' proposal would force devices to scan private content, and both Conservative and Labour governments in the UK have pushed to ban working encryption. Age verification demands that people hand over mountains of ID documents, and those files leak every time.
Governments want a master key that opens every front door, and they assume it will only ever open the bad guys' doors.
Why it matters
A hoarded vulnerability does not stay in government hands: rivals can find it, and criminal gangs can buy it. The weapon built for enemies often ends up hitting the taxpayers who paid for it.
Curated from high-quality sources, with concise summaries and key takeaways.
