Is the NSA liable for not reporting a security vulnerability?
<p>The NSA created several toolsets that involved 0-day exploits that were not reported to the vendors of software &amp; hardware. This put in danger the safety and security of anyone using these pieces of software/hardware. </p>

<p>After public leaks showed the NSA found/created the security holes and the exploits were released to the public. Criminals with malicious intent created several worms and ransomware that spread across the globe causing lots of financial damage and loss.</p>

<p>Would the NSA be liable if anyone directly affected by these worms or ransomware wanted to sue?</p>

<p>Why do you think the NSA (or anyone) has an obligation to report faults in commercial products?</p>

<p>The fault exists in the software -any losses are a matter of contract and consumer law between the customer and the vendor.</p>

<p>Notwithstanding, as an arm of the US government the NSA has sovereign immunity - they can only be sued if the legislation says they can or they agree to be sued.</p>

liability us-federal-government