Resolved: The NSA should disclose zero day vunerabilities to relevant vendors

First off, I would like to apologize for my previous forfeit. I was very sick yesterday and ended up knocking out and sleeping straight through the time I had set aside to respond. I hope we can resume this debate. Onto rebuttals, My opponent claims that Zero days pose little threat to regular people. But actually a zero day exploit was used against adobe to spread ransomware very recently. [1] My opponent also claims that we use firewalls to prevent this sort of exploit, but that's exactly what zero days are for. They are used to surpass those firewalls and find holes within them. Next my opponent claims this: "Big business with "PROPER" security system and IT teams are responsible to secure these threats, adding layers of security, and most importantly preventing any malicious hackers to obtain the requirements for a successful zero-day hacks and to delay malicious hackers to the point where hackers will retreat from pursuing their attacks." It is the IT teams responsibility to secure these threats, but doing so is not possible without knowing the problems exist. This often falls to white hat hackers which find the vulnerabilities and sells them to the company so they can patch them, but that is not a foolproof system as black hate hackers are perfectly able to find the exploits first. No amount of skill and competence an IT team can have will prevent that. "My second argument Vendors should not rely on NSA for their product flaws," This isn't a question of reliance. The fact of the matter is, the NSA is aware of exploits the company isn't and the NSA isn't telling them. It's perfectly reasonable for the companies to expect to be made aware that their software is vulnerable especially because it makes their customers at risk of cybercrime. They're not relying on the NSA because they have other methods of protection, but if the NSA is the only agent who can tell them about the zero days it is not wrong for them to expect the NSA to do so. "My final argument as con is information on zero-day vulnerability cost. Thus, vendors are providing the "bug bounty program" through their own expenses by encouraging and supporting the economy of security researcher to discover those "hard to find zero-day" " The problem with this argument is that Con seems to misunderstand how the market works. Their are white hat hackers and the criminal black hat hackers. The white hackers are fine, they are supporting the cyber security of companies, but black hat hackers are selling them to the highest bigger regardless of what they will use it for. This can be sold to repressive governments, or cybercriminals looking to steal from bank accounts. [2] The black hats would be the one's hurt as the white hat hackers would be working for the same purpose as the NSA. I doubt my opponent really is arguing that we should ensure a well working market for criminals and oppressive governments. "There is a fine difference between zero-day and vulnerabilities of human stupidity, poor firewall configuration, disgruntle employees, etc". Those are vulnerabilities that compromise the cyber-security of US." Not quite, regardless of how competent the staff is, their software is still vulnerable if their is a zero day exploit involved. "Zero-day are commonly describe as "potentials" because it can happen, but most of the time it doesn"t." I won't deny that they aren't used most of the time, but that doesn't mean we shouldn't eliminate the risk of them being used. "Wait, what strengthen the security of the internet against other countries, criminal, and hackers? Are countries, criminal, and hackers trying to harm and break the Internet itself?" Lol no, bad wording on my part. But what is happening is that the software is at risk for being exploited which allows for cybercrime. Such as the ransomware mentioned in my first source. These zero days are targeting specific users often in order to steal information (eg. Credit cards) The internet obviously can't be broken, that wouldn't make any sense and doesn't as it's just IPs connecting to common servers. "Zero-day vulnerability has HUGE market for anybody to purchase, especially our trustee vendors " I agree there and the NSA disclosing the zero days they have wouldn't prevent white hat hackers from continuing business as usual, because the way zero days work is they lose their value as soon as the vendor patches the exploit, because then it's no longer a zero day. White hat hackers SHOULD continue their work, strengthening cyber security. "Now if this is so. if my household of 20 computers don"t update my software for 3 years where computer is filled with zero-days than 'The Internet' will be extremely slow as dial-up, eventually break, and die." I'm just going to apologize for my use of the vague term 'the internet' I'm not claiming that zero days are literally going to destroy the internet, that would be absurd. But, while your internet would not stop working what does happen is your computer and information is vulnerable if it is not patched. You could have your identity stolen, or your credit card info stolen. That is the risk we're running, not the internet itself crumbling. "Looking forward to seeing you in the final round and hope all is well Pro, cheers :)" Looking forward to your response as well, sorry again for my forfeit. Cheers. :) [1] http://www.pcworld.com... [2]