America built the zero-day market that now hits everyone
This Is How They Tell Me the World Ends shows how an offense-first U.S. cyber strategy manufactured the flaw market that later armed rivals, criminals, and mercenaries.
IJR · Nov 6, 2026 · 11 min read
In 60 seconds
- U.S. agencies created sustained demand for secret software flaws, turning zero-days from bragging rights into a seven-figure market other states then entered.
- The NSA’s equities process favored hoarding over patching, and Stuxnet proved both the power and the blowback of that choice.
- Shadow Brokers released NSA tools including EternalBlue in 2016–2017, turning a classified stockpile into a public weapon.
- WannaCry and NotPetya reused those tools within months; NotPetya alone caused an estimated ten billion dollars in damage.
- Firms such as NSO Group commercialized the same capability for authoritarian clients who turned it on journalists and dissidents.
- U.S. grids, water systems, and election infrastructure stayed underdefended while international norms lagged the spread of offense.
The big idea
Perlroth argues the United States manufactured a black-and-gray market for unpatched software flaws to feed its own offensive operations, then watched those weapons proliferate to rivals, criminals, and private mercenaries. Stockpiling secrets instead of fixing them traded short-term advantage for long-term exposure of hospitals, ports, grids, elections, and civil society.
The book in brief
Perlroth starts from a simple object: the zero-day, a flaw the vendor does not know and therefore has not patched. In the 1990s these bugs had little cash value. That changed when U.S. intelligence, especially the NSA, began paying serious money for exclusive access so it could break into targets undetected. Brokers and firms rose to serve that demand, and prices climbed from a few thousand dollars to seven figures for iOS and enterprise targets. China, Russia, Iran, North Korea, and private buyers followed the buyer the United States had created.
She then walks inside the NSA’s Tailored Access Operations culture and its equities process, which was supposed to weigh disclosure against operational use. Offense usually won. Stuxnet in 2010 showed what a stockpile could do to Iran’s Natanz centrifuges, and also what happened when the code escaped and became a study guide for everyone else.
The hinge is the 2016–2017 Shadow Brokers releases, including EternalBlue. A classified arsenal became a download. Weeks later WannaCry, attributed to North Korean operators, used it against Britain’s National Health Service. A month after that, NotPetya, attributed to Russian military intelligence and aimed at Ukraine, hit Maersk, Merck, and TNT Express and racked up an estimated ten billion dollars in global damage.
From there the lens widens to Italy’s Hacking Team and Israel’s NSO Group, whose tools reached governments that turned spyware on journalists, lawyers, and people linked to Jamal Khashoggi. Russian operations from Estonia in 2007 through the 2015–2016 DNC and Podesta hacks get read as a long campaign against underprepared American institutions. Industrial control systems for power, water, and pipelines—much of them old, private, and unevenly regulated—look similarly soft, with Ukraine’s 2015 and 2016 blackouts as live demos.
The close surveys weak UN talks, the Tallinn Manual, bug bounties, and calls for a disclosure-biased equities process. Perlroth finds the core incentive untouched: offense still pays faster than defense, and no country wants to disarm first. She lands on cybersecurity as an infrastructure and public-health problem that needs sustained investment, not just after-action theater.
Context
Nicole Perlroth spent seven years as a New York Times cybersecurity reporter tracing brokers, agencies, and the buyers who price secret flaws. The account mattered on arrival because it documented, with named and anonymous sources inside the American side of the trade, how an offense-first policy built the exposure it was meant to prevent.
The key ideas
1
Buyers made the market
Governments, led by the United States, created the first sustained demand that turned unknown software flaws into a priced commodity.
Early 2000s
Flaws traded for bragging rights or small bounties; little commercial value
By the 2020s
Seven-figure prices for iOS and enterprise exploits sold to governments
A zero-day is a bug the vendor has never seen, so no patch exists and an attacker can slip in quietly. For years hackers traded them for status or small bounties. Serious money arrived when U.S. intelligence decided offense needed a steady private supply of fresh exploits.
Brokers such as the Grugq and firms including Vupen and later Zerodium stood up to auction those flaws to the highest bidder, often a government. Prices moved from a few thousand dollars in the early 2000s to seven figures for iOS and widely used enterprise software by the 2020s.
Perlroth’s claim is blunt: this was not an accident of hacker culture. One deep-pocketed buyer, the U.S. government, manufactured the market, then had to watch China, Russia, Iran, North Korea, and mercenary shops enter the same bazaar. The country most dependent on working software became the country most invested in keeping dangerous flaws secret.
In practice: By the 2020s a single iOS or enterprise exploit could fetch seven figures at auction to a government buyer.
2
Secrecy usually won
The NSA’s equities process was structurally biased toward keeping flaws secret for operations rather than disclosing them for patches.
Disclosure path
Vendor learns the flaw and ships a patch; collective risk falls
Hoarding path
Flaw stays secret for ops; short-term access, long-term shared exposure
Tailored Access Operations built and refreshed the agency’s private stockpile. On paper, an equities review weighed whether a new find should go to the vendor or stay dark for missions. In practice, successful ops were what the mission rewarded, so offense kept winning.
Stuxnet in 2010, a joint U.S.–Israeli strike on Natanz, used multiple zero-days to wreck centrifuges and looked like proof the strategy worked. Then the code got out, researchers tore it apart, and the techniques became a reusable blueprint.
Perlroth treats that escape as the real lesson. A process that counts wins in breached targets will keep hoarding even after the same arsenal becomes a liability waiting to leak.
In practice: Stuxnet’s escape turned a classified sabotage tool into open study material for other actors.
3
One leak, shared weapons
The Shadow Brokers releases of 2016–2017 showed that a concentrated exploit stockpile is a single point of catastrophic failure.
An anonymous group began dumping NSA tools online, peaking with a 2017 suite that included EternalBlue, which hit a flaw in Windows file sharing. Inside the agency and at Microsoft, the scramble was to learn how deep the compromise ran.
Perlroth reads the episode as the predictable end of hoarding, not a freak accident. Once the toolkit was public, anyone who could download it owned a piece of the former advantage. Suspicion pointed at Russian intelligence, but she treats the leaker’s identity as secondary.
Whether state or insider, the design flaw was the same: put the most powerful exploits in one place and you build the blast radius for whoever eventually cracks it.
In practice: EternalBlue, built for NSA use, became a free public exploit after the 2017 dump.
4
American tools, global bills
EternalBlue’s reuse in WannaCry and NotPetya turned one leaked exploit into two of the costliest cyberattacks on record.
Weeks after the dump, WannaCry raced around the world in May 2017, hammering Britain’s National Health Service, delaying surgeries, until a researcher stumbled on a kill switch. Perlroth attributes the worm to North Korean operators using the stolen NSA tool for extortion.
A month later NotPetya, attributed to Russian military intelligence and aimed first at Ukraine, rode the same exploit globally. It slammed Maersk, Merck, and FedEx’s TNT Express unit. Combined damages were estimated at ten billion dollars.
These were not fresh masterpieces. They were repurposed American inventory, back in hostile hands within months, at a price far above whatever intelligence value the original flaw had delivered while it stayed secret.
In practice: Maersk had to reinstall four thousand servers and forty-five thousand computers after NotPetya halted roughly seventy-six port terminals.
5
Offense for any budget
Private vendors turned once-scarce intrusion capability into a product authoritarian governments could buy and aim at civilians.
Italy’s Hacking Team and Israel’s NSO Group sold sophisticated spyware, including NSO’s Pegasus, to government clients around the world. Marketing talked about terrorists and criminals. Reporting traced the same tools to journalists, human-rights lawyers, and people connected to the murdered Saudi journalist Jamal Khashoggi.
Perlroth’s point is market logic, not one bad firm. What used to require a superpower’s lab can now be purchased by a regime with a modest budget and few restraints. NSO’s claim that it vets clients for lawful use collapses when vetting is self-policed and enforcement is thin.
The zero-day trade stops being only a state-on-state problem and becomes a state-on-citizen one: press freedom and civil society sit on the same target list as foreign networks.
In practice: Pegasus deployments reached individuals linked to Jamal Khashoggi despite the lawful-investigation sales pitch.
6
Unready institutions lose
Russian operators treated U.S. political and information systems as a battlefield long before American defenders acted like it.
- 2007Cyberattacks on Estonia
- 2008Operations during the Georgia conflict
- 2015–2016DNC and Podesta email hacks attributed to Fancy Bear and Cozy Bear
Perlroth tracks a line from the 2007 attacks on Estonia and the 2008 Georgia conflict through the 2015–2016 hacks of the DNC and John Podesta’s email, tied to GRU-linked groups Fancy Bear and Cozy Bear. Technical brilliance was not the main story. American campaigns, state election boards, and social platforms lacked coordinated defense and imagination about state aims.
She links that gap to the offense-heavy posture sketched earlier: world-class attack tools at the center, thin institutional energy for protecting domestic civic systems at the edge. The DNC leak through DCLeaks and WikiLeaks worked as an information operation, not only an intrusion, and it fed on polarization already present.
Cyber capability hurts most where the target is unprepared. That pattern foreshadows the infrastructure chapters that follow.
In practice: The 2015–2016 DNC and Podesta intrusions succeeded against campaigns and party organs that had no real state-level defensive posture.
7
Old systems, open doors
Power grids, water plants, and industrial controls stay exposed because owners underinvested in defense for decades.
Design era
Industrial controls built for isolation, reliability, and decades-long life
Connected reality
Same systems linked to networks they were never secured against
Much of the software running U.S. utilities was built before always-on internet links or modern security models. Ownership is private; regulation is uneven; budgets favor uptime and cost over hardening. Perlroth notes researchers who, in sanctioned tests, found paths into American utility networks.
Ukraine’s 2015 and 2016 grid attacks, attributed to Russia, blacked out power for hundreds of thousands and doubled as field tests of technique. The same class of weakness exists across U.S. infrastructure.
An offense-first national habit left little appetite or money for domestic hardening, even after Stuxnet had already proved that infrastructure sabotage works. A grid-scale hit on the United States is a demonstrated capability in a toolkit more people can now reach.
In practice: Russian-attributed strikes on Ukraine’s grid in 2015 and 2016 cut power to hundreds of thousands and showcased methods usable elsewhere.
8
Rules trail the arsenal
International norms and domestic reforms have not matched the speed at which offensive cyber tools spread.
Closing chapters survey UN talks and the Tallinn Manual’s attempt to map old law onto new conflict. Perlroth finds them too slow for the attack tempo already in the wild. Reformers push mandatory disclosure timelines, richer bug bounties, and an equities process tilted toward patching.
None of that dissolves the incentive problem she opened with: offense still shows results faster than defense, cyberweapons stay cheap relative to payoff, and no state wants to go first in disarming. Anonymous sourcing underpins many of the sharpest claims, a limit she cannot escape.
She refuses a neat fix. The United States, she argues, has to treat cybersecurity like infrastructure and public health—steady investment—rather than a string of press conferences after each new fire.
In practice: Proposed fixes include mandatory vulnerability-disclosure timelines and an equities process biased toward patching over stockpiling.
Key terms
- zero-day A software flaw the vendor does not know about yet, so it stays unpatched and usable for quiet break-ins.
- equities process The internal review meant to decide whether a government discloses a flaw for patching or keeps it secret for operations.
- EternalBlue An NSA exploit against Windows file sharing that Shadow Brokers released and that later powered WannaCry and NotPetya.
- Shadow Brokers The anonymous group that dumped NSA hacking tools online in 2016–2017.
- Tailored Access Operations The NSA unit that built and maintained the agency’s stockpile of offensive zero-day tools.
- Pegasus NSO Group’s commercial spyware sold to governments and later traced to targeting of journalists and dissidents.
- NotPetya A 2017 destructive attack attributed to Russian military intelligence that used EternalBlue and caused roughly ten billion dollars in damage.
- bug bounty A program that pays researchers to report flaws to vendors instead of selling them quietly into the exploit market.
What to do
- Audit patch lag this week and confirm your systems would have blocked EternalBlue-class exploits.
- Write down a real vulnerability-disclosure and equities process at your organization instead of leaving it ad hoc.
- Turn on multi-factor authentication and unique passwords for every critical account you touch.
- Make a backup that stays disconnected from your main network and test a restore.
- If you handle corporate or policy risk, ask which offensive security work you fund also creates stockpiled risk elsewhere.
Questions to think with
- When should a government disclose a zero-day rather than keep it for operations?
- What would make private spyware vendors actually accountable for end use?
- How much of WannaCry-scale damage is about leaked exploits versus basic failure to patch?
- Can international cyber norms work if no major state will accept limits first?
- Where does your own workplace still treat patching as routine chores instead of urgent risk?
The other side
Perlroth’s American sourcing is deep, but the book is thinner on Chinese, Russian, and North Korean programs and sometimes states attribution and exploit chains more flatly than specialists who treat them as probabilistic. Critics also argue proliferation may have arrived through independent research and market forces even without U.S. stockpiling, and that missing patches and weak hygiene—not only the zero-day trade—explain much of WannaCry’s harm; heavy use of anonymous sources leaves key claims hard to verify.
Who it's for
National-security and policy readers who want the documented history behind Stuxnet, EternalBlue, and NotPetya; technologists who need to see patching as a geopolitical problem; and general readers trying to understand how the ransomware and infrastructure attacks in the headlines actually get armed.