WikiLeaks leader Julian Assange's revelation last week of the CIA's arsenal of hacking tools had a misplaced tone of surprise. Some scary initial stories argued that the CIA could crack Signal and WhatsApp phone encryption, not to mention your toaster and television. But ... the hardest question here is whether the CIA and other government agencies have a responsibility to disclose to software vendors the holes they discover in computer code, so they can be fixed quickly. This may sound like a no-brainer. The problem is that there's a global market for "zero-day" exploits (ones that are unknown on the day they're used). U.S. intelligence agencies buy some of these exploits; so do other countries' spy services, criminal gangs and the software vendors themselves. A recent report by the Rand Corp. [calculated that] there are about two dozen companies selling or renting exploits to the United States and its allies, with many of these contractors making between $1 million and $2.5 million annually. More than 200 zero-day exploits studied by Rand went undetected for an average of 6.9 years. Given this evidence, Rand argued, "some may conclude that stockpiling zero-days may be a reasonable option" to combat potential adversaries. But let's be honest: The real shocker in the WikiLeaks scoop is the demonstration ... that the U.S. government can't keep secrets. It makes little sense for the CIA to argue against disclosing its cyber-tricks to computer companies if this valuable information is going to get leaked ... anyway.