Most of the weapons used cyberwarfare aren't being built in secret government labs.
They are being built for sale in global cyberbazaars by private individuals living in countries all over the world.
The fact is that most of the people in the US national security system don't get this.
Dan Greer, the information guru at the CIA's venture arm In-Q-Tel, does.
To that end, he has developed some interesting proposals for improving cybersecurity in a world run by global guerrillas.
Proposal 1: The US should be a buyer of zero-day exploits. The US should buy them on the cybermarket and expose them to neutralize them. It works becauce the US has the potential to outbid all other buyers in any auction handily.
The flaw in this? The US national security system would need to act in the public interest and reveal these exploits. I'm not sure the US national security system can do that. It's not in its nature.
Proposal 2: The US should adopt a CDC (Centers of Disease Control) approach to any hack on a US company.
The CDC approach is simple. Whenever certain infectious diseases show up at any hospital (from Ebola to West Nile), medical privacy goes out the window and it must be reported.
The proposal is that certain types of hacks must be reported in the same way, so that they can be rapidly dealt with before other companies or organizations fall victim to it.
The flaw? Most hacks aren't reported because the company involved wants to avoid the negative PR associated with it. That means it's likely that mandatory reporting would be vigorously opposed by corporate America.
Proposal 3: Increase the liability of software vendors that ship compiled code for the losses due to hacks on that software. Additionally, eliminate the liability of software vendors that ship open source code (with copyright).
The flaw? Lots of vested interestes in the software industry will fight this tooth and nail. Not going to happen.