§3316a Reports on Intelligence Community Participation in Vulnerabilities Equities Process of Federal Government

Summary

The Director of National Intelligence must tell the congressional intelligence committees how the intelligence community handles computer and system weaknesses. Not later than 90 days after December 20, 2019, the Director must send a written report that, for each part of the intelligence community, names the official(s) who decide whether a weakness should go into the formal review process, explains how they make that choice under the Vulnerabilities Equities Policy and Process rules (or any successor), and describes that part’s role during a review. If any part makes a major change to its rules or how it decides, that part must report the change to the committees within 30 days. Those reports must be unclassified but may include a classified annex. At least once a year, the Director must give a classified report for the prior year showing the number of weaknesses sent for review, how many were disclosed to the responsible vendor or to the public, and the total number, by category, of weaknesses excluded from review as described in paragraph 5.4 of the VEP document. Each annual report must include an unclassified appendix with the total number disclosed to vendors or the public and the total of those that are known to have been patched. The Director can skip this annual report if an equivalent report under paragraph 4.3 was already sent to Congress and the committees are notified in writing. The Director must make each unclassified appendix available to the public. Vulnerabilities Equities Policy and Process document — the executive branch paper dated November 15, 2017. Vulnerabilities Equities Process — the interagency review set by that document or any successor. Vulnerability — a weakness in a computer system or its parts that could be exploited or harm the confidentiality, integrity, or availability of information.