“I always said when this business got dirty, I’d get out,” Adriel Desautels told me late one summer evening in 2019.

Desautels was a cyberweapon merchant who looked like a milkman. He had an unruly head of curls, frameless glasses, a gap between his front teeth, and a penchant for quoting the astrophysicist Carl Sagan. His original hacker alias, Cyanide, never sat well. He’d eventually change it to the more sensible “Simon Smith.” But in a faceless business, looks meant little. Everyone who was anyone in the game knew Desautels was one of the country’s preeminent zero-day brokers.

When I