Intel Agencies That See Something Should Say Something

Wikileaks’ “Vault7” disclosure last month of apparent CIA hacking tools marked the third recent incident in which an inadvertent public release of alleged government hacking techniques has sent the private sector scrambling to protect users.

The two others involved a release of alleged NSA tools by group that calls itself Shadow Brokers and the publication of a vulnerability used by an unknown law enforcement agency to deanonymize Tor users. These incidents have raised further questions about whether and when the U.S. government should be required to disclose zero-day vulnerabilities, meaning, secret, previously undisclosed flaws for which no ready-made patches exist.