US Used Zero-Day Exploits Before It Had Policies for Them
Around the same time the US and Israel were already developing and unleashing Stuxnet on computers in Iran, using five zero-day exploits to get the digital weapon onto machines there, the government realized it needed a policy …
Context & Ripple Effects
This piece sits at the origin point of the modern zero-day economy: the US and Israel built Stuxnet on five zero-day exploits to reach machines in Iran before Washington had any framework deciding when to hoard or disclose such flaws — the capability came first, the policy and procurement machinery came after. Everything else in the coverage grows out of that inversion.
A decade later the ledger is measurable: FireEye traced 55 zero-day exploits to state-sponsored operations between 2012 and 2019, and researchers showed China reused the NSA's own EpMe exploit against Windows targets for years before the Shadow Brokers leak exposed it. The article's core finding — offense ran ahead of governance — is the throughline connecting all of it.
First-order effects
- Stuxnet burned five zero-days on Iranian nuclear infrastructure while the US government was simultaneously realizing it needed a policy for exactly this decision — meaning stockpile-versus-disclose calls were being made ad hoc by operators, not reviewed under any formal process.
Second-order effects
- Once an exploit leaves government hands it keeps working against everyone: the NSA-built EpMe became a Chinese attack tool for years after its intended use, and the demand side that Stuxnet proved viable seeded the commercial broker market active since the late 1990s that now supplies espionage, organized crime, and war planning alike.
Third-order effects
- The pattern points toward offensive capability permanently outpacing oversight: the Atlantic Council's finding that too few providers and too many middlemen drive up zero-day costs shows the same gap now runs through acquisition economics, not just ethics — states are structurally dependent on a thin, opaque market they never designed.
The trend: State offensive cyber programs have consistently deployed capabilities before building the policies, markets, and supply chains meant to govern them — and are still closing that gap fifteen years later.