§3316a Reports on Intelligence Community Participation in Vulnerabilities Equities Process of Federal Government

Summary

The Director of National Intelligence must tell the congressional intelligence committees how the intelligence community uses the Vulnerabilities Equities Process. Within 90 days after December 20, 2019, the Director must send a written report that says, for each intelligence element, who decides whether a software or system weakness should be sent into the review, how that decision is made, and what that element’s role is during the review. If any element changes its decision rules or process, it must report that change within 30 days. At least once each year, the Director must send a classified report about the prior year that shows how many vulnerabilities were sent for review, how many of those were disclosed to vendors or the public, and the number excluded from review by category. Each annual report must include an unclassified appendix with totals for disclosures and for disclosures known to have been patched. The main reports should be unclassified but may have a classified annex, and the unclassified appendices must be made public. Definitions: “Vulnerabilities Equities Policy and Process document” means the executive-branch paper dated November 15, 2017. “Vulnerabilities Equities Process” means the interagency review run under that document or any replacement. “Vulnerability” means a weakness in an information system or its parts that could be exploited or harm confidentiality, integrity, or availability.