The scariest innovation in the Aurora mass shooting isn’t guns or ammo. It’s SWAT gear.

If those places won’t sell you what you need, try eBay. A search for “bulletproof vest” turns up more than 1,500 items. The high-end vests cost $800, but you can find cheaper government-certified versions—some of them recycled from police use—for less than $100. A search for “ballistic helmet” identifies 140 options, ranging from $1,800 to $50. Holmes chose TacticalGear.com, where you can get armored plates for $220, armor- and plate-carrying vests for $200 to $300, and a ballistic helmet for $435. That’s where he bought an assault vest three weeks ago.

Essentially, Holmes has called the NRA’s bluff. It may be true that the best way to stop a bad guy with a gun is a good guy with a gun. But the best way to stop a good guy with a gun is a bad guy with body armor. And judging from Holmes' vest receipt, he wasn't even buying the serious stuff.

The NRA bases its good-guy approach on a well-substantiated military doctrine: deterrence. By arming myself with a weapon that can hurt you, I discourage you from attacking me. For many years, this doctrine averted war between the United States and the Soviet Union. Each side feared mutually assured destruction. What broke the deadlock wasn’t a weapon. It was a shield: strategic missile defense. The Soviets understood that a system capable of shooting down their nuclear missiles would, by removing their power to deter us, free us to attack. The best offense, it turns out, is a good defense.

That’s what Holmes figured out. Defense, not offense, is the next stage of the gun-violence arms race. Equipping citizens with concealed weapons doesn’t stop bad guys. It just pushes them to the next level. The next level is body armor. And unlike missile defense, which has proved to be complicated and disappointing, body armor is relatively simple.

What’s your answer to this technology? Armor-piercing bullets? Sorry. The NRA, in defense of these bullets, noted 12 years ago that “no law enforcement officer has ever been killed or even injured because an armor piercing bullet penetrated a bullet-resistant vest.” A well-prepared killer just needs the right vest. The key, according to the Justice Department’s site, is to buy “Type IV flexible armor,” which is certified to stop .30-caliber armor-piercing bullets fired at a velocity of 878 meters per second. The site offers contact information for 24 suppliers of Type IV armor and includes URLs for nine of them. I found the options somewhat overwhelming, so I went to Amazon.com, where it took me less than two minutes to find a Type IV plate for $200 and add it to my cart.

Do you want to restrict the sale of body armor? Good luck. In a country that won’t even maintain a ban on assault weapons, what are your chances of blocking access to products that save lives? With guns, as with nukes, it’s a lot harder to make a case against defensive technology than against offensive technology. That’s why not a single state prohibits the purchase of body armor, unless you’re a convicted felon. The toughest law I could find is in Connecticut, where you have to show up in person to complete the sale.

Like the NRA, I’m skeptical that gun laws will stop people like Holmes. The bombs he rigged up in his apartment are pretty good evidence that if he hadn’t gotten his hands on rifles and pistols, he’d have found another way to turn his victims into hamburger. But what if arming the good guys doesn’t work either? What if an Internet full of gas masks and bulletproof vests has plunged us over our heads in an arms race with psychopaths? I wish I could tell you there’s a way out. But like all those poor souls who perished in Aurora, I don’t know how this movie ends.

William Saletan's latest short takes on the news, via Twitter: