Resolved: The NSA should disclose zero day vunerabilities to relevant vendors

Glad to hear back Pro and appreciate that you are able to make time and presenting your challenging argument. I will promptly present my part. The topic is entitled "The NSA should disclose the zero day vulnerabilities to relevant vendors." My position as Con is to disagree to that statement and hereby present my arguments. According to Admiral Michael Rogers the Director of NSA, NSA discloses 91% of "Zero Day Vulnerability" that it has and the remaining 9% are divided with either these vulnerabilities are already patched and the remaining "is kept for National Security reason" [1]. Base on that reference, the 91%, I would argue to be deemed conclusive. This leads to an expanded relative argument should the NSA release remaining single % of the zero day patches to vendors. As again fulfilling my role, I would have to disagree. The remaining vulnerability are being use "for national security reasons" and one-way to deduce is this vulnerability are critical assets to national security. But are those zero-days posing great threats? Unlikely, according to an experience security researcher and the CEO of Netragard an Anti-Hacking and security company explains that "The actual usage of zero-days is quite limited, it is that they hold no real threat for the average business or citizen." [2][3]. Furthering that vulnerability above as stated as "no real threats for citizen or business" but it"s still a threat, but it does not mean that those threats are easily exploitable and in anyway like the unrealistic portraying of Hollywood or Anime. Its quite complex. Very much like our "Networking technology" that we are using everyday are running through layers, including security layers as an example would be "Firewalls" to block intrusion and another layer are "weak / strong secure password detectors". Big business with "PROPER" security system and IT teams are responsible to secure these threats, adding layers of security, and most importantly preventing any malicious hackers to obtain the requirements for a successful zero-day hacks and to delay malicious hackers to the point where hackers will retreat from pursuing their attacks. My second argument Vendors should not rely on NSA for their product flaws, but should have the responsibility to provide and thrive to enhance their quality products, services, and maintaining the integrity and trust to buyers. Meaning taking "the time" to test out these products for security holes, providing top quality bug-free and logic proof codes, scrutinizing quality assurances, and hiring outside consultant, security professional, and especially security researchers. Many companies are taking their own responsibility by doing this via "reward bug bounty program" and through beta-release for testing [5]. My final argument as con is information on zero-day vulnerability cost. Thus, vendors are providing the "bug bounty program" through their own expenses by encouraging and supporting the economy of security researcher to discover those "hard to find zero-day" and as well for help of security professional. This essentially is a way prevents burden of NSA to purchase those vulnerabilities using our taxes and prevents any further violations of ethics as a governmental agency. The reality is zero-days has high cost in the market with often with low probability threats. We are the one to protect ourselves, and our country by reporting threats and flaws to vendors and encourage vendors with our trust for the assurances of bug free products, and lastly to acknowledge and support security researchers and career professional to sustain themselves and the integrity, security, and confidentiality from cybercrimes. [1]. https://fcw.com... [2] http://www.netragard.com... [3] http://arstechnica.com... [5] https://en.wikipedia.org...