Bruce Schneier's written a few times on the subject of what the NSA should do, when coming across a powerful exploit. This can be a surprisingly complex calculu

Bruce Schneier's written a few times on the subject of what the NSA should do, when coming across a powerful exploit. This can be a surprisingly complex calculus when you're thinking solely strategically and not specifically about privacy or ethics as goals in of themselves. https://www.theatlantic.com/technology/archive/2014/05/should-hackers-fix-cybersecurity-holes-or-exploit-them/371197/ https://www.theatlantic.com/technology/archive/2014/05/shoul... In this article, Schneier suggests that if the US and China have an iPhone exploit, and exploits are very rare, then the US should disclose and patch it because it's likely that China has the same exploit. But if exploits are not very rare, then the US should not disclose the one it knows because China probably knows a different one, so the US would lose its capability to spy on China but China would still be able to spy on the US. His conclusion, though, is different, and argues for erring on the side of patching bugs.