Not to nitpick, I absolutely agree that the NSA should be responsible for disclosing this type of information to help secure the USA and its infrastructure.
The CIA on the other hand has clear (though not always followed) directive to only act outside the US and to act against foreign nationals.
It's less clear to me that they should be required to disclose these. Another post makes the claim that the CIA may have lost these, that case seems clearer that they must disclose to protect US interests.
The problem is that there are very few IT systems that are purely foreign.
For example, if the CIA finds an exploit in a wireless router made in China and sold all over the world, that hole can also be found by others and used against targets in the United States.
Is being able to hack others worth letting ourselves get hacked?
> Is being able to hack others worth letting ourselves get hacked?
The answer to this for me is a clear no. What I was more questioning is given the CIA's role and job, I don't think it's necessarily their responsibility to do it. We're talking about a government agency who's purpose is to collect information about potential threats against the US, they have no reason to want to make that harder on themselves.
If you want to debate changing the role of the CIA, and if or if not it should exist, that's a different set of questions. But given what their job is, why would they want to turn that funnel of information off? It's not in their interest to do that.
I want everything to be hyper secure on the internet, but I also know that there are threats against the US (some created because of our actions) which the CIA is responsible for trying to keep an eye on.
A similar question: is it worth being hacked so that we can know that there is an imminent attack coming against some US interest?
EDIT: I know that the CIA is responsible for some really ugly things in the world, I'm not defending any of those actions. I'm speaking more of what their theoretical function is and what responsibilities they have in disclosing some of this information.
If you want to debate changing the role of the CIA, and if or if not it should exist, that's a different set of questions. But given what their job is, why would they want to turn that funnel of information off? It's not in their interest to do that.
However, the CIA is still a part of the US Government, and as such it still should have a responsibility to work towards outcomes that are best for the US overall. When this appears to be in conflict with their direct mission, in many cases the correct response should be to punt the decision upstairs.
You wouldn't expect the US Forestry Service to take decisions harmful to the overall country even if it made their direct mission easier, would you?
If while performing counter-intelligence the CIA discovers that a foreign government/company can/is exploiting computer systems within the US, should the CIA have a responsibility to do anything?
I don't believe the clear answer to that is Yes. I'm not sure if it is No either. Maybe they should share that intelligence with the NSA, but I can imagine if sharing that intelligence would compromise the the mission of the CIA then they wouldn't.
The CIA on the other hand has clear (though not always followed) directive to only act outside the US and to act against foreign nationals.
It's less clear to me that they should be required to disclose these. Another post makes the claim that the CIA may have lost these, that case seems clearer that they must disclose to protect US interests.