> Third possibility: their role involves securing domestic infrastructure, in which case they should be looking for vulns and getting them fixed. IIRC this actu

> Third possibility: their role involves securing domestic infrastructure, in which case they should be looking for vulns and getting them fixed. IIRC this actually is part of their statutory mandate, alongside offensive operations. This sounds similar to what IAD does. The difference is that IAD focuses on securing systems against entire classes of vulnerabilities and attacks. SID has the mission of gathering signals intelligence, so that is why it makes sense for them to utilize individual zero day vulnerabilities. They need to get into an adversary system, so vulnerabilities are required (when needed) to get that access.