I was under the impression that the three letter agencies and contractors bought vulnerabilities?