The Perfect Weapon: War, Sabotage, and Fear in the Cyber Age

by David E. Sanger

Furthermore, the talk in Washington about cutting down on the use of contractors who dealt with the nation’s deepest secrets fizzled almost immediately. “We had to go to Congress and quietly explain how cyberweapons get developed,” one NSA official said to me. In short, the NSA told Congress, cyberweapons get built the way everything else gets built—by private firms. The Pentagon relies on Lockheed Martin to build the F-35, with a raft of subcontractors and partners. General Atomics builds the Predator and Reaper, the two best-known drones. Boeing builds satellites. Booz Allen, and many firms from the outskirts of Fort Meade to Silicon Valley, build cyberweapons. Those firms hunt for—or surreptitiously purchase—“zero-day” flaws: software flaws in a system that an invader can exploit to spy or destroy. The programming talent required to turn those flaws into weapons is expensive, and contractors can afford top talent. They offer their best coders salaries many times what the government can pay. “People would be shocked,” one young employee of one of the most successful cyber contractors told me, “how much the government relies on contractors to build the weapons and maintain them,” even in foreign systems. That explains why about one-third of the 1.4 million people with top-secret clearances in 2012 were private contractors. (And yes, the background checks for those contractors are often performed by other contractors.)