At a DefCon (15, I think?) I got to ask a panel of FBI/CIA/NSA bigwigs a question at an open Q/A panel. I asked how they made the decision of which exploits the

At a DefCon (15, I think?) I got to ask a panel of FBI/CIA/NSA bigwigs a question at an open Q/A panel. I asked how they made the decision of which exploits they'd keep for themselves and which they'd help the project patch. The response was 100% boilerplate. "We have a system for evaluating it," was the basic answer, in more words than that. I didn't really expect anything more, but it was worth a shot. I've never believed that their "system" was in any way primarily for the public interest. I can't point to any specific evidence, it just never felt like the type of thing they would do. Good exploits just seemed far too useful to be worth giving up.