Software and computer systems are a standard target of intelligence collection in an age where everything from your phone to your sneakers has been turned into a connected computing device. A modern government intelligence organization must maintain access to some software vulnerabilities into order to target these devices. However, the WannaCry ransomware and NotPetya attacks have called attention to the perennial flipside of this issue—the same vulnerabilities that the U.S. government uses to conduct this targeting can also be exploited by malicious actors if they go unpatched.

Amid a bad news week for the Trump team, a new lawsuit highlight an under-explored theory of possible criminal liability: violation of the Computer Fraud and Abuse Act.

In the wake of a recent failure to reach international consensus on the application of international law to cyber activities, the United States should seek to shape norms unilaterally by continuing to assertively investigate and indict individuals—including state actors—who engage in cyber activities that the U.S. Government ultimately would like to see the international community characterize as wrongful.

The most recent ransomware attack, which spread across Europe, the United States, and Asia yesterday, represents a chilling evolution in the worm-as-weapon.