§3242 Annual reports on certain cyber vulnerabilities procured by intelligence community and foreign commercial providers of cyber vulnerabilities

Summary

The CIA Director and the NSA Director must send a joint report each year through 2026 to the congressional intelligence committees, working with the Director of National Intelligence. Each report must list every cyber weakness bought from foreign commercial sellers during the report period and give for each one: what it is, when it was bought, whether it was bought alone or with others, how much it cost, who sold it (and who originally made it if different), what country it came from, and whether the intelligence community can use it and if so whether for operations or for research and an approximate timeline. The report must also say which foreign sellers are a serious national security risk or have sold tools to foreign governments that targeted U.S. people, the U.S. Government, journalists, or dissidents, or that have a pattern of human rights abuses, and whether the intelligence community did business with those sellers in the prior 5 years. Reports may be classified. Commercial provider: a person or company that sells or brokers cyber weaknesses. Cyber vulnerability: a tool, exploit, or code meant to compromise a device, network, or system, including items bought for research.