White House Discloses Rules on Weaponizing Software Vulnerabilities

The Trump administration pledged Wednesday to release an annual report outlining the government’s decision-making about when it discloses newfound computer vulnerabilities to the public and when it will hoard them to hack and spy on U.S. adversaries.

The move marks a significant step forward for the government’s “vulnerabilities equities process,” which transparency advocates have complained is far too opaque and too often leaves citizens’ personal information vulnerable when those undisclosed exploits, known as zero days, are discovered by criminals.

The move also comes as U.S. intelligence agencies’ ability to protect their undisclosed zero days is being called into question by major breaches at the CIA and National Security Agency.

Those breaches “undermine public confidence and damage our ability to carry out intelligence missions,” White House Cybersecurity Coordinator Rob Joyce acknowledged in a blog post describing the new vulnerabilities review process.

The annual report will include “statistical information as deemed appropriate” about vulnerability reviews as well as any changes to the board that reviews newfound vulnerabilities, according to the charter released Wednesday.

That board, which is led by NSA, includes representatives from across the civilian government, including the White House, Commerce, Treasury, State, Energy, Homeland Security and Justice departments, as well as from the Pentagon, the Director of National Intelligence’s office and the CIA, the charter states.

The board will meet within five days of learning about a new zero day and will weigh numerous factors including how likely adversaries and criminals are to discover the vulnerability and exploit it against companies and citizens, how much damage those adversaries and criminals could cause and how effectively the vulnerability could be mitigated if it was disclosed, the charter states.

The board will also consider what benefits intelligence agencies, the military and law enforcement could glean from the vulnerability if it remained undisclosed and any diplomatic fallout if it came to light that the U.S. had hoarded the vulnerability.

Undisclosed vulnerabilities will be re-reviewed every year, according to the charter. If the government discovers someone else is exploiting the vulnerability, the board will meet to re-review it within 24 hours.

The process also requires NSA to submit for review any vulnerabilities in encryption algorithms, such as those used by tech companies to allow citizens to communicate securely.

Law enforcement officials have argued that warrant-proof encryption systems that shield communications even from the company that provides the communication service, are allowing criminals and terrorists to recruit and plan operations unencumbered.

The Obama administration first revealed basic details about its process for reviewing zero days in 2014 after a public outcry that the NSA may have known about—but not disclosed—a major vulnerability in an open-source security system that was later exploited by the Heartbleed bug.

NSA denied having known about the bug.

Obama administration officials also revealed the following year that NSA typically discloses about 91 percent of the vulnerabilities it encounters. That percentage remains roughly accurate, Joyce said last week at the Defense One Summit, where he previewed the review process update.

Wednesday’s update increases transparency about the review process but is unlikely to quell concerns from transparency groups or some security advocates who want more zero days to be disclosed.

Joyce described the review process in his blog post as the government’s best effort to balance “a tension between the government’s need to sustain the means to pursue rogue actors in cyberspace…and its obligation to share its knowledge of flaws in software and hardware with responsible parties.”

He described the idea of disclosing all vulnerabilities as “tantamount to unilateral disarmament.”

Even some of the harshest critics of government hoarding vulnerabilities still make exceptions for vulnerabilities that are unlikely to affect companies and citizens. A vulnerability that only affects a computer system used by the North Korean government, for example, would not affect the broader world if it remained undisclosed.