Nations are engaging in a cyberweapons arms race, with agencies like the NSA prioritizing offensive capabilities over defense, fueling a lucrative 0-day market
Amid a global gold rush for digital weapons, the infrastructure of our daily lives has never been more vulnerable. Tweets: @hatr , @nicoleperlroth , @newyorker , @hoanssolo , @scottshanenyt , and @hatr Tweets: Hakan / @hatr : “In 2015, a former N.S.A. hacker, David Evenden, was part of a team that gained access to Michelle Obama's e-mails on behalf of the United Arab Emirates” https://www.newyorker.com/... https://twitter.com/... Nicole Perlroth / @nicoleperlroth : The @NewYorker 's Jill Lepore reviews my book, “This Is How They Tell Me The World Ends,” our Feb 9. [Read through hands clasped tightly over eyes 👀 whilst ommmmmmmmmm-ing]. https://www.newyorker.com/... @newyorker : A new book by the cybersecurity reporter Nicole Perlroth is interested in one particular plague—governments using hacking as a weapon of war—but it also raises the question of whether that's the root of a lot of other evils. https://nyer.cm/dXrrPJt Franz-Stefan Gady / @hoanssolo : „[T]he N.S.A. has a hundred analysts working on cyber offense for every analyst working on cyber defense." https://www.newyorker.com/... Scott Shane / @scottshanenyt : Can't wait to read this book by my former Snowden reporting pal https://twitter.com/... Hakan / @hatr : Hand to God I'd read articles and maybe even books about every single case described in this one paragraph alone https://www.newyorker.com/... https://twitter.com/...
Context & Ripple Effects
Jill Lepore's review lands alongside Nicole Perlroth's book on governments weaponizing hacking, and it closes a loop the desk has been following since 2017, when reporting showed the NSA had lost control of its own cyberweapons after the Shadow Brokers leaks. The new wrinkle is personnel, not just code: former NSA hackers like David Evenden are now selling their skills to foreign clients, including a team that accessed Michelle Obama's emails on behalf of the United Arab Emirates.
The commercial layer was already visible in the rivalry between NSO Group and DarkMatter for authoritarian-government contracts, and Wired's oral history from early 0-day brokers shows the market predates the current gold rush. What the New Yorker piece adds is the scale argument: with the NSA reportedly staffing roughly 100 offensive analysts per one defender, the supply side of this industry is a deliberate policy choice.
First-order effects
- The NSA's own arsenal keeps boomeranging onto American targets — IDT Corporation CIO Golan Ben-Oni surfaced DoublePulsar, a more potent sibling of WannaCry, straight out of the agency's toolset.
- Ex-agency talent is now a export product: Evenden's UAE work shows the same skills the government trains being redeployed against US persons at home.
Second-order effects
- A vendor class has formed around the demand — NSO Group and DarkMatter compete openly for authoritarian clients, turning surveillance capability into an off-the-shelf purchase rather than a state-built program.
- The 0-day broker trade that began as a niche in the late 1990s now feeds espionage, organized crime, and war planning simultaneously, so every hoarded exploit raises prices across the whole market.
Third-order effects
- Insider leakage is the systemic counterweight: prosecutions like Joshua Schulte's over the alleged CIA arsenal leak show the US treating its own hackers as the primary proliferation risk.
- If offense-first doctrine holds, defense consolidates into coalitions — the US tech, NATO-intel, and Ukrainian hacker partnership that blunted Russia's offensive cyber operations previews what collective defense looks like when no single agency can hold the line.
The trend: Offensive cyber capability is shifting from a state monopoly to a global market of brokers, vendors, and mercenary hackers, with leaked and sold exploits setting the tempo of the arms race.