This Is How They Tell Me the World Ends: The Cyberweapons Arms Race

This Is How They Tell Me the World Ends is a bestselling nonfiction book written by former New York Times lead cybersecurity journalist Nicole Perlroth. Published in 2021, this book recounts Perlroth’s years-long investigation into the shadowy global market for “zero-day exploits”— critical security vulnerabilities in software that are discovered, weaponized, and utilized by governments, criminals, and mercenaries all around the world. 

Perlroth introduces the fundamentals of hacking, provides insight into the US government’s role in the global cyber arms race, and explores themes such as The Impact of Digital Espionage on Privacy and Civil Liberties, The Role of Hacking in Modern International Relations and Conflicts, and The Responsibility to Safeguard Digital Infrastructure. This Is How They Tell Me the World Ends was awarded the prestigious Financial Times Business Book of the Year award in 2021.

This guide refers to the 2022 Bloomsbury paperback edition.

Summary

This Is How They Tell Me the World Ends consists of seven named parts subdivided into 23 titled and numbered chapters that also include a subtitle noting the primary location of their events. Each part, which is preceded by a relevant quote, focuses on a different phase in the development of the zero-day market and examines different factions of the information security industry. Technical information on hacking is embedded in accounts of significant events and milestones and presented within the context of Perlroth’s personal experience with navigating and investigating the world of zero-day exploits.

The book begins an Author’s Note and a Prologue. The Author’s Note discusses Perlroth’s efforts to secure sources and fact-check information despite the high levels of discretion and secrecy common to all hacking and espionage circles. The Prologue warns of the USA’s vulnerability to Russian cyberattacks and recounts Perlroth’s 2019 trip to Kyiv, where she witnessed the impact of Russia’s prolonged state-sponsored campaign of digital sabotage and harassment against Ukraine.

Part 1 (“Mission Impossible”) explains Perlroth’s role as a cybersecurity journalist for the New York Times and provides information on the international market for critical software vulnerabilities known as zero-day exploits. In the first chapter, “Closet of Secrets,” Perlroth describes her work analyzing and breaking the 2013 Snowden Leaks, the high-profile illegal publication of leaked confidential documents about the National Security Agency’s domestic espionage activities in the USA. 

Chapter 2 (“The Fucking Salmon”) recounts the wall of silence that met her initial inquiries into zero-day exploits. She also describes her consequent resolve to thoroughly investigate and publicly expose the zero-day market: a goal that she set for herself upon attending a hacking conference in Florida.

Part 2 (“The Capitalists”) focuses on a handful of individuals who were instrumental to the development of the zero-day market in its earliest stages. Chapter 3 (“The Cowboy”) is named for its central figure, John P. Watters, a Texas-born venture capitalist and the former owner of the cybersecurity company iDefence. His pioneering strategy of paying freelance hackers to find and report software bugs and vulnerabilities made him one of the world’s first mainstream buyers of zero-days. 

Chapter 4 (“The First Broker”) centers on an anonymous figure nicknamed Sabien who was one of the first brokers to earn a living by working as an intermediary between other hackers and US intelligence agencies, selling information on bugs and exploits to be used in digital espionage. 

Chapter 5 introduces hacker and academic “Zero-Day Charlie,” who became renowned for his discovery of numerous high-profile zero-day exploits. He also garnered recognition for his publication of a paper on the early zero-day market and his founding role in the No More Free Bugs movement that protested the unfair treatment of hackers.

Part 3 (“The Spies”) presents the rise of the USA’s National Security Agency (NSA) to dominance in early global digital espionage and cyberwarfare spheres. Chapter 6 (“Project Gunman”) describes the discovery of highly sophisticated recording devices in the US embassy in Moscow during the Cold War era, as well as the impact that this investigation had on the NSA’s subsequent information security practices. 

Chapter 7 (“The Godfather”) is named for James R. Gosler, a veteran government agent who used his unparalleled hacking skills to found and shape the NSA’s early cybersecurity and cyberespionage task forces. Chapter 8 (“The Omnivore”) describes changes to the NSA’s domestic espionage activities in the wake of 2001’s 9/11 terrorist attacks; at this point, the agency was indiscriminately harvesting huge quantities of communication data from American citizens. 

Chapter 9 (“The Rubicon”) describes the USA’s “Stuxnet” attack on Iranian nuclear reactors; this was the first time in history that one nation deployed a cyberweapon to disrupt the infrastructure of another. The final chapter of this part, “The Factory,” focuses on subsequent developments in the NSA’s information security policies, which included heavy investments in offensive capabilities, expanded task forces, and the collection of a stockpile of potentially critical zero-day exploits.

Part 4 (“The Mercenaries”) examines a handful of private individuals and companies who have profited selling zero-day exploits and information security services to government agencies all around the world. “The Kurd,” the figure for whom Chapter 11 is named, is Sinan Eren, a former hacktivist who fought government oppression in his native Turkey and later left the American cybersecurity sector due to the ethical bankruptcy of the selling practices involved. This chapter also discusses the trend of Emeriti companies that recruit former NSA hackers to work against American interests. 

Chapter 12 (“Dirty Business”) focuses on Adriel Desautels, who closed his brokerage company after learning that one of his customers, HackingTeam, sold zero-days to governments and groups that were committing human rights abuses. The final chapter in this part, “Guns for Hire,” exposes the Israeli spyware company called NSO Group, whose smartphone hacking tools were used illegally by the Mexican president against dissidents among his own citizens. Perlroth reported on this case, prompting riots in Mexico and making herself the target of similar tactics.

Part 5 (“The Resistance”) covers the response of major American tech companies to hacks of their platforms and software, and their attempts to protect users from government espionage. Chapter 14 is named for the Aurora attacks, in which Chinese government-backed hacking groups infiltrated Google’s source code in 2009, prompting the company to revamp its security policies and temporarily pull out of the Chinese market. Chapter 15 (“Bounty Hunters”) details efforts by tech companies and entrepreneurs to establish incentives and systems for freelance hackers to report zero-day bugs directly to software companies. Chapter 16 (“Going Dark”) focuses on the use of encryption to foil government espionage and cites the 2015 court case between Apple and the FBI; the case addressed Apple’s refusal to circumvent their own iPhone encryption.

Part 6 (“The Twister”) tells of the developments in which the USA’s primacy in the digital sphere was usurped, and the author also discusses some major global cyberattacks of the early 2010s. Chapter 17 (“Cyber Gauchos”) recounts Perlroth’s 2014 visit to a hacking conference in Buenos Aires, where she witnessed the booming community of young Argentine hackers who are willing to sell zero-days indiscriminately to the highest bidder. Chapter 18 (“Perfect Storm”) details a series of global cyberattacks conducted by government agencies in Iran and North Korea, as well as the American government’s response to these attacks. The final chapter in this part, Chapter 19 (“The Grid”), explains that Russian hackers have long since infiltrated America’s digital infrastructure, including the electrical grid and nuclear facilities. Russian attacks on Ukraine show their ability and willingness to disrupt, turn off, and potentially detonate these systems.

In Part 7, Chapter 20 (“Boomerang”) recounts recent developments in the cyber arms race, in which the USA is targeted by hostile actors using tools developed by the NSA and tactics honed over years of covert operations. Chapter 20 (“The Russians are coming”) first discusses the “Vulnerabilities Equities Process” that the NSA uses to determine which zero-days to report and which ones to stockpile. The chapter then presents a clear and comprehensive account of Russian interference in the 2016 US election, including propaganda and misinformation campaigns and the hacking of the Democratic National Committee. 

Chapter 21 (“The Shadow Brokers”) presents the large-scale leak of NSA cyberespionage tools and cyberweapons by a mysterious but potentially Russian-affiliated hacking group called the Shadow Brokers. Chapter 22 (“The Attacks’) tells of instances in which NSA developed exploits—particularly “EternalBlue”—that were weaponized against major targets. Prime examples include the 2017 North Korean “WannaCry” attacks and the Russian “NotPetya” attack. The book’s final chapter (“The Backyard”) warns that by the end of 2020, the first Trump administration’s diplomatic blunders and mishandling of cyberthreats had significantly weakened the nation’s security and status as a world-leading tech power.

The epilogue focuses on solutions to these widespread threats and vulnerabilities. Specifically, Perlroth discusses the fact that the COVID-19 pandemic has influenced her perspective on prospects for mitigating the damage of cyberattacks. She also summarizes the important takeaways of the book and encourages readers to take action.