From the ‘I‘ve always wondered‘ files:
LAS VEGAS. I’m in the super mega Feds vs Ex-Feds panel now at Black Hat and already I’ve learned something I didn’t know.
There is a divergence of opinion in the security industry about whether or not people should buy zero-day exploits. Tipping Points has a whole business model built around it and it seems to work for them – but what about the government?
Does the US Government buy zero-day exploits?
“I don’t buy zero days,” US-CERT director Mischel Kwon said.
Kwon is just one branch of the government.
The NSA had a less specific answer.
“I can tell you we have a policy but I’m not going to tell you what it is,” NSA agent Richard Marshall said.
PIC: Richard Marshall Credit: Sean M. Kerner
