§3242 Annual Reports on Certain Cyber Vulnerabilities Procured by Intelligence Community and Foreign Commercial Providers of Cyber Vulnerabilities

Summary

The directors of the CIA and NSA, working with the Director of National Intelligence, must send a yearly report to the congressional intelligence committees through 2026. Each report must list foreign commercial companies that sold cyber vulnerabilities to the intelligence community and describe each purchase: what the vulnerability is, when it was bought, whether it was bought alone or with others, how much it cost, who sold it (and who originally made it if different), the country it came from, and whether the intelligence community can use it now and later (for operations or for research) and roughly when. The report must also say which foreign sellers are a serious threat to U.S. security or have sold vulnerabilities to foreign governments that used them to target U.S. people, the U.S. government, journalists, or dissidents, or that have a pattern of human rights abuses. It must say if the intelligence community did business with those sellers in the five years before the report. The report can be classified. "Commercial provider" means anyone who sells or brokers a cyber vulnerability. "Cyber vulnerability" means a tool, exploit, bug, or code meant to compromise a device, network, or system, including items bought for research.