Book argues US demand created zero-day market that spread globally

1

Buyers made the market

Governments, led by the United States, created the first sustained demand that turned unknown software flaws into a priced commodity.

A zero-day is a bug the vendor has never seen, so no patch exists and an attacker can slip in quietly. For years hackers traded them for status or small bounties. Serious money arrived when U.S. intelligence decided offense needed a steady private supply of fresh exploits.

Brokers such as the Grugq and firms including Vupen and later Zerodium stood up to auction those flaws to the highest bidder, often a government. Prices moved from a few thousand dollars in the early 2000s to seven figures for iOS and widely used enterprise software by the 2020s.

Perlroth’s claim is blunt: this was not an accident of hacker culture. One deep-pocketed buyer, the U.S. government, manufactured the market, then had to watch China, Russia, Iran, North Korea, and mercenary shops enter the same bazaar. The country most dependent on working software became the country most invested in keeping dangerous flaws secret.

In practice: By the 2020s a single iOS or enterprise exploit could fetch seven figures at auction to a government buyer.

2

Secrecy usually won

The NSA’s equities process was structurally biased toward keeping flaws secret for operations rather than disclosing them for patches.

Tailored Access Operations built and refreshed the agency’s private stockpile. On paper, an equities review weighed whether a new find should go to the vendor or stay dark for missions. In practice, successful ops were what the mission rewarded, so offense kept winning.

Stuxnet in 2010, a joint U.S.–Israeli strike on Natanz, used multiple zero-days to wreck centrifuges and looked like proof the strategy worked. Then the code got out, researchers tore it apart, and the techniques became a reusable blueprint.

Perlroth treats that escape as the real lesson. A process that counts wins in breached targets will keep hoarding even after the same arsenal becomes a liability waiting to leak.

In practice: Stuxnet’s escape turned a classified sabotage tool into open study material for other actors.

3

One leak, shared weapons

The Shadow Brokers releases of 2016–2017 showed that a concentrated exploit stockpile is a single point of catastrophic failure.

An anonymous group began dumping NSA tools online, peaking with a 2017 suite that included EternalBlue, which hit a flaw in Windows file sharing. Inside the agency and at Microsoft, the scramble was to learn how deep the compromise ran.

Perlroth reads the episode as the predictable end of hoarding, not a freak accident. Once the toolkit was public, anyone who could download it owned a piece of the former advantage. Suspicion pointed at Russian intelligence, but she treats the leaker’s identity as secondary.

Whether state or insider, the design flaw was the same: put the most powerful exploits in one place and you build the blast radius for whoever eventually cracks it.

In practice: EternalBlue, built for NSA use, became a free public exploit after the 2017 dump.

4

American tools, global bills

EternalBlue’s reuse in WannaCry and NotPetya turned one leaked exploit into two of the costliest cyberattacks on record.

Weeks after the dump, WannaCry raced around the world in May 2017, hammering Britain’s National Health Service, delaying surgeries, until a researcher stumbled on a kill switch. Perlroth attributes the worm to North Korean operators using the stolen NSA tool for extortion.

A month later NotPetya, attributed to Russian military intelligence and aimed first at Ukraine, rode the same exploit globally. It slammed Maersk, Merck, and FedEx’s TNT Express unit. Combined damages were estimated at ten billion dollars.

These were not fresh masterpieces. They were repurposed American inventory, back in hostile hands within months, at a price far above whatever intelligence value the original flaw had delivered while it stayed secret.

In practice: Maersk had to reinstall four thousand servers and forty-five thousand computers after NotPetya halted roughly seventy-six port terminals.

5

Offense for any budget

Private vendors turned once-scarce intrusion capability into a product authoritarian governments could buy and aim at civilians.

Italy’s Hacking Team and Israel’s NSO Group sold sophisticated spyware, including NSO’s Pegasus, to government clients around the world. Marketing talked about terrorists and criminals. Reporting traced the same tools to journalists, human-rights lawyers, and people connected to the murdered Saudi journalist Jamal Khashoggi.

Perlroth’s point is market logic, not one bad firm. What used to require a superpower’s lab can now be purchased by a regime with a modest budget and few restraints. NSO’s claim that it vets clients for lawful use collapses when vetting is self-policed and enforcement is thin.

The zero-day trade stops being only a state-on-state problem and becomes a state-on-citizen one: press freedom and civil society sit on the same target list as foreign networks.

In practice: Pegasus deployments reached individuals linked to Jamal Khashoggi despite the lawful-investigation sales pitch.

6

Unready institutions lose

Russian operators treated U.S. political and information systems as a battlefield long before American defenders acted like it.

Perlroth tracks a line from the 2007 attacks on Estonia and the 2008 Georgia conflict through the 2015–2016 hacks of the DNC and John Podesta’s email, tied to GRU-linked groups Fancy Bear and Cozy Bear. Technical brilliance was not the main story. American campaigns, state election boards, and social platforms lacked coordinated defense and imagination about state aims.

She links that gap to the offense-heavy posture sketched earlier: world-class attack tools at the center, thin institutional energy for protecting domestic civic systems at the edge. The DNC leak through DCLeaks and WikiLeaks worked as an information operation, not only an intrusion, and it fed on polarization already present.

Cyber capability hurts most where the target is unprepared. That pattern foreshadows the infrastructure chapters that follow.

In practice: The 2015–2016 DNC and Podesta intrusions succeeded against campaigns and party organs that had no real state-level defensive posture.

7

Old systems, open doors

Power grids, water plants, and industrial controls stay exposed because owners underinvested in defense for decades.

Much of the software running U.S. utilities was built before always-on internet links or modern security models. Ownership is private; regulation is uneven; budgets favor uptime and cost over hardening. Perlroth notes researchers who, in sanctioned tests, found paths into American utility networks.

Ukraine’s 2015 and 2016 grid attacks, attributed to Russia, blacked out power for hundreds of thousands and doubled as field tests of technique. The same class of weakness exists across U.S. infrastructure.

An offense-first national habit left little appetite or money for domestic hardening, even after Stuxnet had already proved that infrastructure sabotage works. A grid-scale hit on the United States is a demonstrated capability in a toolkit more people can now reach.

In practice: Russian-attributed strikes on Ukraine’s grid in 2015 and 2016 cut power to hundreds of thousands and showcased methods usable elsewhere.

8

Rules trail the arsenal

International norms and domestic reforms have not matched the speed at which offensive cyber tools spread.

Closing chapters survey UN talks and the Tallinn Manual’s attempt to map old law onto new conflict. Perlroth finds them too slow for the attack tempo already in the wild. Reformers push mandatory disclosure timelines, richer bug bounties, and an equities process tilted toward patching.

None of that dissolves the incentive problem she opened with: offense still shows results faster than defense, cyberweapons stay cheap relative to payoff, and no state wants to go first in disarming. Anonymous sourcing underpins many of the sharpest claims, a limit she cannot escape.

She refuses a neat fix. The United States, she argues, has to treat cybersecurity like infrastructure and public health—steady investment—rather than a string of press conferences after each new fire.

In practice: Proposed fixes include mandatory vulnerability-disclosure timelines and an equities process biased toward patching over stockpiling.