US Used Zero-Day Exploits Before It Had Policies for Them