Nicole Perlroth, This Is How They Tell Me the World Ends: The Cyberweapons Arms Race (Book Review)

By jgn on Saturday, January 22, 2022 in Reading, Reviews, and Technology

This is a capacious narrative about how the world has engaged in cyber warfare since 2013. In large part it is about "zero day" exploits, which are bug discoveries that only the holder knows; with a zero day against Microsoft Windows, for instance, the attacker can go in and there's nothing anyone can do about it. The United States's NSA and Department of Defense have many zero day exploits that they keep under wraps. Perlroth explains how the business of trading zero days evolved, and how entities have used them. I've been following Perlroth's articles in the NY Times for some time, but the book has the great advantage of pulling everything together into a story.

But perhaps more importantly, she explains the politics around zero days: For example, it's in the NSA's interest to hold zero days so that they can -- if they want -- exploit computers in, say, Russia. But if a zero days starts being used by other entities, then the value of holding it goes to zero: And the NSA should be notifying Microsoft so they can fix the bug. Some years ago, a horde of NSA zero days were made public. Since the bugs these zero days depend on were never fixed, our computers becomes exploitable.

Perlroth is a courageous journalist: She probably put herself in danger a number of times, and the book tells that story, too. There's also quite a bit in here about the mess of the Trump administration when it comes to cyber. Fortunately, some bold souls in the government repeatedly did the right things, and we avoided some truly horrendous situations.

The epilogue contains a number of recommendations for how the United States could manage zero days better: It's very clear and very concrete. At one point in the epilogue she apologizes a bit for the book maybe not being that technical: But the broad scope, discussion politics, business, and the ethics of cyber war balances out the avoidance of drilling down into the tech.

Highly recommended.

Originally reviewed on Goodreads on 22 January 2022.