This Is How They Tell Me the World Ends

A zero-day is a flaw in software or hardware that the vendor doesn't know about and hasn't patched. Nicole Perlroth shows how a loose community of hackers who once traded such bugs for bragging rights turned into a global market, with government agencies, led by those of the United States, as the biggest buyers. Her central argument is that American hubris drove that market: the US stockpiled offensive tools rather than disclosing flaws, then lost control of its own arsenal when NSA hacking tools leaked and turned up in attacks that crippled hospitals, ports and multinational companies.

Perlroth spent years covering cybersecurity for the Times. The book won the 2021 Financial Times and McKinsey Business Book of the Year award, and Kirkus called it a powerful case for strong cybersecurity policy.

Publishers Weekly was less impressed. It found the tone breathless and the technical detail thin. Helen Patton of Ohio State's Institute for Cybersecurity and Digital Trust praised the depth of its history but faulted inaccuracies and bias. Readers who want technical depth should pair it with Kim Zetter's Countdown to Zero Day or Andy Greenberg's Sandworm.

For finance readers it is an introduction to systemic cyber risk, the kind that can halt payment systems, supply chains and insured operations at once, and to who is selling the weapons.

1. Cyber risk is systemic. A single exploit in widely used software can hit thousands of firms at once, so losses correlate in ways that insurers, lenders and investors often underestimate.
2. Governments are the biggest buyers of vulnerabilities. State agencies pay top dollar for zero-days and keep them secret, which leaves everyone else's software unpatched.
3. Weapons leak. Tools built for espionage can be stolen and reused by criminals and hostile states, so stockpiling them creates risks for the stockpiler.
4. Back doors cut both ways. Government demands for access to encrypted systems and devices create weaknesses that others can exploit, a tension the book traces between security agencies and civil liberties.
5. Connectivity is exposure. The most digitized economy has the largest attack surface, and that is why the United States is so vulnerable to cyberattack.

The book opens with Russia's 2017 cyberattack on Ukraine and then goes back to tell how the zero-day market was built, roughly in chronological order.

1. Into the market. Starting from her reporting around the 2013 Snowden leaks, Perlroth finds a secretive world where hackers, brokers and governments buy and sell software flaws, with almost no one willing to talk on the record.
2. The capitalists. Early bug hunters move from posting flaws publicly to selling them, as security firms and then brokers start paying, and prices rise into the millions.
3. The spies. American intelligence agencies, above all the NSA, become the market's biggest customers and build arsenals of exploits, culminating in Stuxnet.
4. The mercenaries. The trade spreads to brokers and contractors who sell surveillance and hacking capabilities to other governments, including authoritarian ones. Freelance hackers who once shared their finds start hoarding them for profit.
5. The boomerang. China, Iran, North Korea and Russia build their own capabilities. The Shadow Brokers leak lets adversaries use NSA tools in attacks such as WannaCry and NotPetya, and US infrastructure, with the world's largest attack surface, is exposed. Perlroth closes with recommendations for patching, disclosure and defense.

'An intricately detailed, deeply sourced and reported history of the origins and growth of the cyberweapons market . . . Hot, propulsive . . . Sets out from the start to scare us out of our complacency' New York Times 'A terrifying exposé' The Times 'Part John le Carré and more parts Michael Crichton . . . Spellbinding' New Yorker Zero day: a software bug that allows a hacker to break in and scamper through the world's computer networks invisibly until discovered. One of the most coveted tools in a spy's arsenal, a zero day has the power to tap into any iPhone, dismantle safety controls at a chemical plant and shut down the power in an entire nation – just ask the Ukraine. Zero days are the blood diamonds of the security trade, pursued by nation states, defense contractors, cybercriminals, and security defenders alike. In this market, governments aren't regulators; they are clients – paying huge sums to hackers willing to turn over gaps in the Internet, and stay silent about them. This Is How They Tell Me the World Ends is cybersecurity reporter Nicole Perlroth's discovery, unpacked. A intrepid journalist unravels an opaque, code-driven market from the outside in – encountering spies, hackers, arms dealers, mercenaries and a few unsung heroes along the way. As the stakes get higher and higher in the rush to push the world's critical infrastructure online, This Is How They Tell Me the World Ends is the urgent and alarming discovery of one of the world's most extreme threats.