> because the NSA would use their sizeable budget to discover and disclose vulnerabilities Right now, the process is: 1. Find a way to survey the target envir

> because the NSA would use their sizeable budget to discover and disclose vulnerabilities Right now, the process is: 1. Find a way to survey the target environment, learn what software and hardware they are running 2. Acquire vulnerabilities to exploit the known target software/hardware, either from a third-party, a contractor, or manual reverse engineering of those specific components. 3. Adapt mission specific payloads to use on the target. 4. Use for as long as needed. 5. Disclose to vendor after the purpose is served. If the agency mission changed to be purely about discovery and reporting, that might not help the general public. If this were to happen, it seems like the focus would likely be on protection of only software/hardware in classified systems, as that is already their defensive mission. Instead of having things like EternalBlue patched we would have them open and available for a different party to discover. That seems worrisome to me, but I am really curious to know if you might have a different take on how this would work.