§3316a Reports on intelligence community participation in vulnerabilities equities process of Federal Government

Summary

Requires the Director of National Intelligence to send reports to the congressional intelligence committees about how the intelligence community handles computer and system weaknesses under the Vulnerabilities Equities Process. The law names three terms: the "Vulnerabilities Equities Policy and Process" document (an executive-branch paper dated November 15, 2017), the "Vulnerabilities Equities Process" (the interagency review under that document), and "vulnerability" (a weakness in an information system that could be exploited or harm confidentiality, integrity, or availability). Within 90 days after December 20, 2019, the Director must report, for each part of the intelligence community, who decides whether a weakness should go to the review, how they make that decision, and what their role is during the review. If any part changes its decision rules or process, it must report that change within 30 days. Reports must be unclassified but can include a classified annex. Once each year the Director must send a classified report with counts: how many weaknesses were submitted, how many were disclosed to each vendor or to the public, and the total by category of those excluded from review (per paragraph 5.4). Each annual report must include an unclassified appendix with the totals disclosed and the totals known to have been patched. The Director may skip the annual report if an equivalent report under paragraph 4.3 has already been given to Congress, and must make the unclassified appendix public.