This Is How They Tell Me the World Ends

The author began covering the cybersecurity beat for the New York Times in 2010. By 2013, she was already feeling the side-effects of the job. She’d uncovered stories of Chinese hackers getting inside everything from printers to thermostats, and trying to steal intellectual property that ranged from military planes to the formula for Coca-Cola. Iranian hackers had already brought down the network for the Saudi oil company Aramco, wiped its data, and destroyed 30,000 computers while leaving an image of a burning American flag on every screen.

So, after just a few years reporting on the topic, anything with a plug was beginning to look suspicious. As a much-needed escape from the internet, the author booked a weeklong tour through Kenya. But her African vacation was cut short when Edward Snowden decided to give the world a peek into the dark recesses of America’s National Security Agency, or NSA.

In his position as an NSA contractor, Snowden leaked thousands of highly classified NSA documents. These documents revealed that America’s premier spy agency was – surprise – pretty good at spying. In fact, its tools and capabilities were better than most.

The bigger surprise was that many people believed that digital encryption was still keeping networks and information safe. Snowden’s leak blew that line of thinking wide open. It was clear that the NSA had found a myriad of ways to hack around encryption.

In some cases, the NSA was paying companies to give it backdoor access to their data, but, in other cases, the backdoors came from what are known as zero-days. Now, a zero-day is essentially a flaw in a piece of hardware or software that, when exploited, allows someone undetected access. This means the flaw hasn’t been made public, so there’ve been zero days for the company to come up with a patch. For example, if you surf the web using Microsoft Explorer, a zero-day flaw for that web browser could allow someone to invisibly hack into your browser, steal your passwords, credit card information, or emails – and even download your data or record your keystrokes.

The Snowden leaks showed that the NSA had accumulated a good number of zero-days that provided it with access to all of the most widely-used apps, social-media platforms, phones, computers, and operating systems. When this news got out, some people assumed that companies like Apple and Microsoft were in cahoots with the NSA. But this wasn’t the case. These companies were livid when they learned that the NSA knew about these zero-days and didn’t let them fix the flaws.

Perhaps even more worrisome is the fact that the NSA didn’t always find and develop these zero-days itself. It bought them, with taxpayer money, from hackers around the world. As we’ll see in the next blink, the marketplace for zero-days is a morally dubious gray zone that has only gotten darker in recent years.