The NSA created several toolsets that involved 0-day exploits that were not reported to the vendors of software & hardware. This put in danger the safety and security of anyone using these pieces of software/hardware.

After public leaks showed the NSA found/created the security holes and the exploits were released to the public. Criminals with malicious intent created several worms and ransomware that spread across the globe causing lots of financial damage and loss.

Would the NSA be liable if anyone directly affected by these worms or ransomware wanted to sue?


Why do you think the NSA (or anyone) has an obligation to report faults in commercial products?

The fault exists in the software -any losses are a matter of contract and consumer law between the customer and the vendor.

Notwithstanding, as an arm of the US government the NSA has sovereign immunity - they can only be sued if the legislation says they can or they agree to be sued.

  • The NSA can absolutely be sued: eff.org/cases/jewel Jul 7 '17 at 2:21
  • As far as the point of your answer, I can understand where you are going with it and partially agree. But the NSA has been proven to intentionally backdoor hardware even before the product goes to the consumer. Doesn't this open the door to liability? Jul 7 '17 at 2:24
  • 2
    @DigitalFire that case involves a breach of a specific law by the NSA - it is not a common law damages suit.
    – Dale M
    Jul 7 '17 at 2:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.