This Is How They Tell Me the World Ends: The Cyberweapons Arms Race

by Nicole Perlroth

The NSA faced a quandary: its solution to dealing with the bad actors in the world was escalating an arms race that only made the United States more vulnerable to attack. The NSA’s answer to this problem was a system called Nobody But Us (NOBUS). The premise behind NOBUS was that low-hanging fruit—vulnerabilities that could easily be discovered and abused by American adversaries—should be fixed and turned over to vendors for patching. But more advanced exploitation—the kind of advanced zero-days the agency believed only it had the power, resources, and skills to exploit—would remain in the agency’s stockpile and be used to spy on American enemies or degrade their systems in the case of a cyberwar. Michael Hayden, the former NSA chief who ran the agency until 2005, addressed NOBUS this way: “You look at a vulnerability through a different lens if even with the vulnerability it requires substantial computational power or substantial other attributes, and you have to make the judgment: Who else can do this? If there’s a vulnerability here that weakens encryption, but you still need four acres of [supercomputers] in the basement in order to work it, you kind of think NOBUS, and that’s a vulnerability we are not ethically or legally compelled to try to patch—it’s one that ethically and legally we could try to exploit in order to keep Americans safe from others.”