§3242 Annual Reports on Certain Cyber Vulnerabilities Procured by Intelligence Community and Foreign Commercial Providers of Cyber Vulnerabilities

Summary

The Director of the CIA and the Director of the NSA, working with the Director of National Intelligence, must send a report each year to the congressional intelligence committees through 2026. The report can be classified. Each report must list each cyber vulnerability the intelligence community bought from foreign commercial sellers and give basic facts: what the vulnerability is, when it was bought, whether it was bought alone or with others, how much it cost, who sold it and who originally made it if different, the country it came from, and whether and when the intelligence community can use it (for operations or for research). The report must also say which foreign sellers are a serious national-security risk or sold vulnerabilities to foreign governments that targeted U.S. people, the U.S. Government, journalists, or dissidents, or that have a pattern of human-rights abuses. It must say whether the intelligence community did business with those sellers in the past 5 years. A commercial provider is anyone who sells or brokers vulnerabilities. A cyber vulnerability is any tool, exploit, code, or weakness meant to break into a device, network, or system, including items bought for research.