> The C.I.A.'s lack of a heads-up to corporations impacted by the exploits... I am having some trouble understanding this. They don't just stumble across vulne

> The C.I.A.'s lack of a heads-up to corporations impacted by the exploits... I am having some trouble understanding this. They don't just stumble across vulnerabilities by accident, they either purchase them or specifically look for them in a device's firmware, in order to implant the device of an intelligence target. The article seems to indicate that CIA should be reporting vulnerabilities instead of using them. It does not address the fact that, with such a policy in place, there would no longer be a reason for them to spend time/cash seeking these vulnerabilities. I am very interested in understanding a reasonable counterpoint to this.