A booming trade in bugs is undermining cyber-security

This Is How They Tell Me The World Ends. By Nicole Perlroth. Bloomsbury; 528 pages; $21 and £14.99

IF YOU DISCOVER that a favourite vending-machine dispenses free chocolate when its buttons are pressed just so, what should you do? The virtuous option is to tell the manufacturer, so it can fix it. The temptation is to gorge. More lucrative still might be to sell the trick to others—including those with larger appetites and fewer scruples. But when the weaknesses of a system can be bought and sold, the results can be calamitous, as “This Is How They Tell Me The World Ends” shows.

Nicole Perlroth, a cyber-security correspondent for the New York Times, has produced an engaging and troubling account of “zero-day exploits”. An exploit is a piece of code that takes advantage of a vulnerability in software, typically to gain access or do harm. A zero-day exploit is rarer: it targets a hitherto undiscovered—and therefore undefended—blind spot.

Twenty years ago, exploits for Windows software yielded “pennies on the dollar”, a former hacker recalls. But as software became ubiquitous—running utilities, nuclear plants and warplanes—it grew more alluring. Zero-days became the “blood diamonds of the security trade”, says Ms Perlroth, fetching six or seven figures depending on their target and potency.

Such price signals worked as you would expect. Young men—in this story, there are few women—who once unearthed bugs for fun found a rich seam in governments eager to acquire and stockpile zero-days for use against their rivals. A high-minded hacker could choose to sell the fruits of his labour to defenders rather than attackers, as software companies began offering ever-larger “bug bounties”. Google even matched bounties that hackers donated to charity; one German whizz thus lavished funds on kindergartens in Togo, schools in Ethiopia and solar plants in Tanzania.

The trouble is that spiritual rewards tend to pale beside pecuniary ones. “If we wanted to volunteer, we’d help the homeless,” sneers Chaouki Bekrar, the French founder of Vupen, one of many brokers that bought exploits from hackers and sold them, at spiralling prices, to intelligence agencies. Many such brokers were veterans of America’s National Security Agency (NSA), who realised they could make far more money selling exploits to their old employers than churning them out in-house for a government wage.

Some of those former spooks insist that they will sell zero-days only to supposedly reputable clients, such as American spy agencies and police forces. But Ms Perlroth paints a picture of a global market in which deep-pocketed autocrats can snap up exploits to use against foes and dissidents with little oversight. When French regulators revoked Vupen’s export licence, it simply upped sticks—to Washington, DC.

This secretive market is difficult to penetrate, but Ms Perlroth has dug deeper than most and chronicles her efforts wittily. Her focus is on America, the world’s pioneering and pre-eminent cyber-power, which, she persuasively argues, has tilted too far towards cyber-offence. She describes how the NSA sucked talent away from the defence-minded Department of Homeland Security: “It had always been more fun to be a pirate than to join the Coast Guard.” She is right that American spies, like most others, hoarded zero-days and backdoors in software for longer than is advisable, rather than disclosing them to technology companies, in the mistaken belief that rivals could not worm through the same holes. (Spoiler: they did, as Ben Buchanan described in “The Hacker and the State”, published last year.)

Yet Ms Perlroth lays too much blame at America’s door. Its willingness to pay top dollar for zero-days inflated their prices, but that does not mean it “spawned and sponsored” today’s market. The author herself vividly documents a flourishing business in Europe and Latin America, buoyed by customers from Singapore to Tajikistan. China and Russia buy hacking tools, and use them, not because America showed them how, but because they can. The trade in digital lock-picks has thrived not because America stimulated parts of it in the 1990s and 2000s, but because what is behind the locks has become pivotal to economies and societies everywhere. ■