> But while protecting customers from attack is important, some argue that counter-terrorism operations are different, with potentially life and death consequen

> But while protecting customers from attack is important, some argue that counter-terrorism operations are different, with potentially life and death consequences that go beyond day-to-day internet security. Maybe they shouldn't base life or death consequences on something as capricious as the existence of an undetected 0-day. It's not just Google, what about other security companies, independent white-hats, etc? The alternative is basically saying, "you shouldn't/can't improve software security, coz terrorism", which not only feels super unethical, but also likely a 1st amendment violation.