UNCLASSIFIED Vulnerabilities Equities Policy and Process for the United States Government November 15, 2017 1. Purpose This document describes the Vulnerabilities Equities Policy and Process for departments and agencies of the United States Government (USG) to balance equities and make determinations regarding disclosure or restriction when the USG obtains knowledge of newly discovered and not publicly known vulnerabilities in information systems and technologies. The primary focus of this policy is to prioritize the public's interest in cybersecurity and to protect core Internet infrastructure, information systems, critical infrastructure systems, and the U.S. economy through the disclosure of vulnerabilities discovered by the USG, absent a demonstrable, overriding interest in the use of the vulnerability for lawful intelligence, law enforcement, or national security purposes. The Vulnerabilities Equities Process (VEP) balances whether to disseminate vulnerability information to the vendor/supplier in the expectation that it will be patched, or to temporarily restrict the knowledge of the vulnerability to the USG, and potentially other partners, so that it can be used for national security and law enforcement purposes, such as intelligence collection, military operations, and/or counterintelligence. The U.S. Government’s determination as to whether to disseminate or restrict a vulnerability is only one element of the vulnerability equities evaluation process and is not always a binary determination. Other options that can be considered include disseminating mitigation information to certain entities without disclosing the particular vulnerability, limiting use of the vulnerability by the USG in some way, informing U.S. and allied government entities of the vulnerability at a classified level, and using indirect means to inform the vendor of the vulnerability. All of these determinations must be informed by the understanding of risks of dissemination, the potential benefits of government use of the vulnerabilities, and the risks and benefits of all options in between. This document defines the policy and process for evaluating competing considerations to inform U.S. Government decisions. 2. Background In accordance with paragraph (49) of National Security Policy Directive-54/Homeland Security Policy Directive-23, Cybersecurity Policy, and the Joint Plan for the Coordination and Application of Offensive Capabilities to Defend U.S. Information Systems, the USG created the VEP. In the course of carrying out USG missions, the USG may identify vulnerabilities that cyber actors could exploit. In the vast majority of cases, responsibly disclosing a newly discovered vulnerability is clearly in the national interest. However, there are legitimate advantages and disadvantages to disclosing vulnerabilities, and the trade-offs between prompt disclosure and withholding knowledge of some vulnerabilities for a limited time or adopting a mitigation strategy short of full disclosure can have significant consequences. UNCLASSIFIED UNCLASSIFIED It is also important to recognize that the USG has not created these vulnerabilities. Information systems will continue to have vulnerabilities and efforts to discover and disclose these flaws is an ongoing need. Contributions by the Intelligence Community (IC) have been significant in securing modern information technology. If the USG were to adopt a policy of immediate disclosure, there would still be vulnerabilities present that would be discovered and potentially exploited by other cyber actors. For years, the USG’s process to robustly consider and disclose vulnerabilities was the only such process known amongst both our peers and our adversaries. Vulnerabilities can have significant economic, privacy and national security implications when exploited. The USG and the private sector are at risk due to our dependency on cyberspace. The USG is committed to an open, interoperable, secure, and reliable Internet and understands vulnerabilities in technologies underpinning the Internet threaten both security and liberty. Any system, including those we rely on for critical infrastructure, can be a target for malicious cyber activity. Interests in protecting the public from criminal cyber intrusions are often implicated by decisions to restrict or disseminate a vulnerability, particularly in the absence of meaningful mitigation. Unpatched vulnerabilities leave not only USG systems, but also the systems of commercial industry and private citizens, vulnerable to intrusion. Vulnerabilities are also used in the course of authorized military, intelligence, and law enforcement activities. At times, intelligence and evidence discovered through judicious exploitation of a vulnerability are the only means to understand a much bigger threat. Often taking a considered risk to restrict knowledge of a vulnerability is the only way to discover significant intrusions that are compromising security and privacy. For these reasons, vulnerability disclosure raises a multitude of considerations that require careful deliberation through an interagency process with a diversity of viewpoints. Competing USG missions require coordination and collaboration to protect information systems and citizens from malicious cyber activity. Additionally, the USG must be able to conduct law enforcement, military and intelligence activities to the fullest extent practical and in accordance with the laws that govern these activities. Since there can be competing considerations for disclosing or restricting a vulnerability, it is important that the equity process be led outside any single agency. For this reason, the process is coordinated by the National Security Council (NSC) staff so that multiple agency viewpoints can be considered, informed by the full input and consideration of the interagency experts. 3. Scope This policy supersedes the Commercial and Government Information Technology and Industrial Control Product or System Vulnerabilities Equities Policy and Process, dated February 16, 2010. Otherwise, nothing in this policy is meant to supersede existing U.S. laws, regulations, executive orders, and directives to protect National Security Systems (NSS), Sensitive Compartmented Information, or other 2 UNCLASSIFIED USG systems and information. This policy will be implemented consistent with the statutory authorities and responsibilities of the heads of participating agencies. This policy applies to all USG components and personnel (i.e., civilian, military, and contractors) and includes Government off-the-shelf (GOTS), Commercial off-the-shelf (COTS), or other commercial information systems (to include open-source software), Industrial Control Systems (ICS) or products, and associated systems such as Supervisory Control and Data Acquisition (SCADA) and Distributed Control Systems (DCS). This policy is not intended to prevent the USG from taking immediate actions to protect its network(s) or warn entities actively threatened by a malicious cyber event, including ongoing unauthorized access to information systems. 4. Participation in VEP 4.1. Equities Review Board and VEP Director The Equities Review Board (ERB) is the primary forum for interagency deliberation and determinations concerning the VEP. The ERB will meet monthly, but may also be convened sooner if an immediate need arises. The ERB will consist of representatives from the following agencies who are authorized to represent the views of their respective agency head:  Office of Management and Budget  Office of the Director of National Intelligence (to include Intelligence Community-Security Coordination Center (IC-SCC))  Department of the Treasury  Department of State  Department of Justice (to include the Federal Bureau of Investigation and the National Cyber Investigative Joint Task Force (NCIJTF))  Department of Homeland Security (to include the National Cybersecurity Communications and Integration Center (NCCIC) and the United States Secret Service (USSS))  Department of Energy  Department of Defense (including the National Security Agency (NSA) (including Information Assurance and Signals Intelligence elements)), United States Cyber Command, and DoD Cyber Crime Center (DC3))  Department of Commerce  Central Intelligence Agency 3 UNCLASSIFIED Other USG agencies may participate when demonstrating responsibility for, or identifying equity in, a vulnerability under deliberation. Changes to the name of an agency will not affect its participation in this process. Each agency participating in the VEP will designate an agency point of contact (POC) to act as the focal point for vulnerability submissions for their respective organization and the primary contact for the VEP Executive Secretariat. The VEP POC will ensure one or more Subject Matter Experts (SME) from their agency are identified to support equities determinations and discussions as needed. The VEP Director at the NSC will be responsible for ensuring effective implementation of VEP policies. The VEP Director is the Special Assistant to the President and Cybersecurity Coordinator, or an equivalent successor. 4.2. VEP Executive Secretariat The NSA will support VEP governance by serving as the Executive Secretariat for the VEP, acting at all times under the authority, direction, and control of the Secretary of Defense. The VEP Director may designate another agency to perform this function with the permission of the head of that agency. The VEP Executive Secretariat function will be executed so as to remain neutral and independent. The VEP Executive Secretariat will facilitate information flow, discussions, determinations, documentation, and recordkeeping for the process. The VEP Executive Secretariat will keep formal records of this information to permit later review of the overall efficacy of the process. Specific duties of the VEP Executive Secretariat include:  Maintain VEP POC, SME, and ERB member contact information.  Maintain records of all vulnerabilities that have been identified to the VEP Executive Secretariat. At a minimum, records will include the submitting agency, the dissemination determination and date, and whether reassessment is necessary. Other pertinent information may also be recorded.  Create an annual report as described in Section 4.3.  Document and maintain records of the contested preliminary determination process described in Section 5.2.6. 4.3. Annual Reporting The VEP Executive Secretariat will produce an annual report that will be submitted to the VEP POCs and the NSC staff through the Special Assistant to the President and Cybersecurity Coordinator, or an equivalent successor. The report will be written at the lowest classification level permissible and will 4 UNCLASSIFIED include, at a minimum, an executive summary written at an unclassified level. As part of a commitment to transparency, annual reporting may be provided to the Congress. The annual report will include statistical data as deemed appropriate by the VEP Director for the reporting period beginning on October 1 and ending on September 30. Changes, if any, to the following will also be included in the annual report:  ERB membership.  Reassignment of the VEP Director responsibility to another position.  Realignment of the VEP Executive Secretariat responsibility to another agency. 5. Process 5.1. Threshold for Entering VEP Agencies will submit vulnerabilities that meet the threshold. To enter the process, a vulnerability must be both newly discovered and not publicly known in accordance with the definitions in Annex A. 5.2. Workflow Figure 1 outlines the Vulnerability Equities Process that will be initiated when a vulnerability is identified for equities review. 5 UNCLASSIFIED SUBMISSION Department or agency identifies and submits vulnerability meeting threshold NOTIFICATION VEP Executive Secretariat notifies VEP POCs EQUITY AND DISCUSSIONS Departments and agencies claim equity, concur/non-concur with recommendation to disseminate or restrict, and may hold discussions to reach consensus DETERMINATION Consensus? Yes No ERB ratifies recommendation ERB votes and renders a decision CONTESTED PRELIMINARY DETERMINATIONS Departments and agencies that claimed equity may appeal for consideration via the NSC process HANDLING & FOLLOW-ON ACTIONS May include sharing, restricting, or reassessing Figure 1: Vulnerability Equities Process Overview 6 UNCLASSIFIED 5.2.1. Submission When an agency determines that a vulnerability reaches the threshold for entry into the process, it will notify the VEP Executive Secretariat as soon as is practicable and provide its recommendation to either disseminate or restrict the vulnerability. The submission will include, at a minimum, information describing the vulnerability, identification of the vulnerable products or systems, and a recommendation on dissemination of the vulnerability information. 5.2.2. Notification The VEP Executive Secretariat will notify all VEP POCs within one business day of acknowledging the submission and request that participants respond if they have an equity at stake. 5.2.3. Equity and Discussions An agency that claims an equity must indicate whether it concurs with the recommendation to disseminate or restrict within 5 business days. The primary purpose of sharing among agencies is to gain consensus on recommendations for the ERB. If an agency does not concur with a recommendation to disseminate or restrict, one or more SMEs from the submitting agency will hold discussions with the non-concurring agency or agencies and the VEP Executive Secretariat within 7 business days to reach consensus. If no consensus is reached, the participants will provide options for the ERB. 5.2.4. Determination to Disseminate or Restrict Decisions whether to disclose or restrict a vulnerability will be made quickly, in full consultation with all concerned agencies, and in the overall best interest of USG missions of cybersecurity, intelligence, counterintelligence, law enforcement, military operations, and critical infrastructure protection. To the extent possible and practical, determinations to disclose or restrict will be based on repeatable techniques or methodologies that enable benefits and risks to be objectively evaluated by VEP participants. This process employs techniques that include assessment factors such as prevalence, reliance, and severity in accordance with the equity considerations in Annex B. ERB determinations for follow-on actions and next steps should be reached in a timely fashion. When there is consensus among those agencies that claimed an equity, the timeline will be shortened. It is the intent of VEP participants that ERB determinations be made by consensus. If the ERB members cannot reach consensus, they will vote on a preliminary determination. If an agency with an equity 7 UNCLASSIFIED disputes the preliminary determination of the ERB, that participant may, by providing notice to the VEP Executive Secretariat, elect to contest the preliminary determination in accordance with Section 5.2.6. If no agency contests a preliminary determination, it will be treated as a final determination. 5.2.5. Handling and Follow-on Actions If vulnerability information is released, dissemination will be made in the most expeditious manner and when possible within 7 business days. Disclosure of vulnerabilities submitted for equity review will be conducted according to agreed-upon guidelines that are consistently and responsibly followed by all members. The submitting agency is presumed to be most knowledgeable about the vulnerability and, as such, will be responsible for disseminating vulnerability information to the vendor. If the submitting agency so chooses, it may elect to delegate dissemination responsibility to another agency on its behalf. The releasing agency will promptly provide an information copy of dissemination information to the VEP Executive Secretariat for record keeping. Additionally, the releasing agency is expected to follow-up so the ERB can determine whether the vendor’s action meets USG requirements. If the vendor chooses not to address a vulnerability, or is not acting with urgency consistent with the risk of the vulnerability, the releasing agency will notify the VEP Executive Secretariat, and the USG may take other mitigation steps. If vulnerability information will be restricted, the submission will be reassessed annually by the ERB until dissemination is accomplished, the vulnerability is publicly known, or the vulnerability is otherwise mitigated. Submitting agencies are also responsible for engaging with other VEP members to address various mitigation options, regardless of a decision to disseminate or restrict, which may include engaging a broader stakeholder community beyond the USG. 5.2.6. Contested Preliminary Determinations Disputes arising from the VEP, including any challenges by an agency to a preliminary determination by the ERB, will be resolved using the process described in National Security Presidential Memorandum (NSPM)-4, of April 4, 2017, Organization of the National Security Council, the Homeland Security Council, and Subcommittees. If an agency participating in the VEP wishes to contest a preliminary determination, it will notify the VEP Executive Secretariat of its intent to do so and the basis for its decision within 5 business days of the ERB’s preliminary determination. The VEP Executive Secretariat will notify the VEP Director. Disclosure of any vulnerabilities preliminary determined to be disclosable will be delayed until the matter has been resolved. If a policy concern arises within the Executive Office of the President over an ERB preliminary determination, the VEP Director will arrange for further discussion with the ERB. 5.3. Considerations Making consistent, informed determinations and understanding risk is critical to ensure an equitable review of vulnerability information. Consideration of defensive, military, intelligence and operational, 8 UNCLASSIFIED commercial, international relationships, and law enforcement equities is required when making vulnerability equities determinations. All USG agencies will appropriately safeguard information concerning vulnerabilities identified by other entities, to include private businesses, researchers, and foreign governments. As appropriate, the USG will work with such entities to encourage them to disclose vulnerabilities consistent with international standards and/or current best practices, and/or take additional actions to reduce risk. The USG's decision to disclose or restrict vulnerability information could be subject to restrictions by foreign or private sector partners of the USG, such as Non-Disclosure Agreements, Memoranda of Understanding, or other agreements that constrain USG options for disclosing vulnerability information. If a vulnerability is found in GOTS equipment or systems that were certified by NSA, or in any cryptographic function, whether in hardware or software, certified or approved by NSA, then the vulnerability will be reported to NSA as soon as practical. NSA will assume responsibility for this vulnerability and submit it formally through the VEP Executive Secretariat. When an agency discovers ongoing malicious cyber activity that exploits a vulnerability that is subject to a prior and ongoing decision to restrict, the USG entity will immediately report this information to the VEP Executive Secretariat. In such circumstances, the vulnerabilities equities discussion will begin no later than the business day following notification to the VEP Executive Secretariat, and participants will expeditiously reach consensus on disclosure or appropriate mitigation actions, or raise issues to the ERB. 5.4. Exceptions There are specific, limited categories of vulnerabilities that may be excluded from VEP review. The United States Government's decision to disclose or restrict vulnerability information could be subject to restrictions by partner agreements and sensitive operations. Vulnerabilities that fall within these categories will be cataloged by the originating Department/Agency internally and reported directly to the Chair of the ERB. The details of these categories are outlined in Annex C, which is classified. Quantities of excepted vulnerabilities from each department and agency will be provided in ERB meetings to all members. Vulnerabilities identified through security researcher activity and incident response that are intended to be disclosed in a rapid fashion will not be subject to adjudication by the VEP. The following will not be considered to be part of the vulnerability evaluation process: 9 UNCLASSIFIED  Misconfiguration or poor configuration of a device that sacrifices security in lieu of availability, ease of use or operational resiliency.  Misuse of available device features that enables non-standard operation.  Misuse of engineering and configuration tools, techniques and scripts that increase/decrease functionality of the device for possible nefarious operations.  Stating/discovering that a device/system has no inherent security features by design. 10 UNCLASSIFIED Annex A Definitions The following terms are defined to clarify their use in the Vulnerability Equities Policy and Process document. Commercial offthe-shelf (COTS) A software and/or hardware product that is freely available or commercially ready-made and available for sale, lease, or license to the general public. Equities Review Board (ERB) Primary forum for interagency deliberation and determinations concerning the VEP, with senior level representation from agencies with authorities and responsibilities in national defense, homeland security, law enforcement, and national intelligence. Core membership is coordinated through the NSPM-4 process. Other agencies may be invited to participate when demonstrating responsibility for or identifying equity in a vulnerability submission under deliberation. Exploit A tool, code, or action designed to take advantage of a vulnerability and execute unexpected or unintended behavior, or impact confidentiality, integrity, or availability of information. Government offthe-shelf (GOTS) A software and/or hardware product that is developed by the technical staff of a government agency for use by the USG. GOTS software and hardware may be developed by an external entity, but with funding and specification from the agency, and can normally be shared among Federal agencies without additional cost. GOTS products and systems are not commercially available to the general public Industrial Control System (ICS) A term that encompasses several types of control systems to include SCADA systems, DCS, and other smaller control system configurations such as skid-mounted Programmable Logic Controllers (PLC) often found in the industrial sectors and critical infrastructures. ICSs are typically used in industries such as electricity, water, oil, and gas distribution. Based on information received from remote stations, automated or operator-driven supervisory commands can be pushed to remote station control devices, which are often referred to as field devices. Field devices control local operations such as opening and closing valves and breakers, collecting data from sensor systems, and monitoring the local environment for alarm conditions. Newly Discovered After February 16, 2010, the effective date of the initial Vulnerabilities Equities Process, when the USG discovers a zero-day vulnerability or new zero-day vulnerability information, it will be considered newly discovered. 11 UNCLASSIFIED This definition does NOT preclude entry of vulnerability information discovered prior to February 16, 2010. Publicly known A vulnerability is considered publicly known if the vendor is aware of its existence and/or vulnerability information can be found in the public domain (e.g., published documentation, Internet, trade journals). Vulnerability A weakness in an information system or its components (e.g., system security procedures, hardware design, internal controls) that could be exploited or impact confidentiality, integrity, or availability of information. A type of vulnerability that is unknown to the vendor, exploitable, and not publicly known. Zero-Day Vulnerability 12 UNCLASSIFIED Annex B Equity Considerations The list below enumerates core considerations the Vulnerability Equities Process and Policy will use when evaluating vulnerability equities. These considerations have been selected to help decisionmakers weigh the benefits to U.S. national security and national interest when deciding whether to disclose or restrict knowledge of an identified vulnerability. Evaluations will not be limited to applying only these considerations, but these represent general concerns, which should apply to all vulnerability equity decisions. The questions are phrased assuming that the USG has detailed non-public knowledge of a vulnerability in some commercially available product, component, system, or program (the ‘product’) sold, distributed, or supplied by some private sector party (the ‘vendor’). Note that in all of the discussions about product usage, intelligence and law enforcement value, mitigations, and other areas, care should be taken to consider both current and near-term future conditions. Part 1 – Defensive Equity Considerations 1.A. Threat Considerations • Where is the product used? How widely is it used? • How broad is the range of products or versions affected? • Are threat actors likely to exploit this vulnerability, if it were known to them? 1.B. Vulnerability Considerations • What access must a threat actor possess to exploit this vulnerability? • Is exploitation of this vulnerability alone sufficient to cause harm? • How likely is it that threat actors will discover or acquire knowledge of this vulnerability? 1.C. Impact Considerations • How much do users rely on the security of the product? • How severe is the vulnerability? What are the potential consequences of exploitation of this vulnerability? • What access or benefit does a threat actor gain by exploiting this vulnerability? • What is the likelihood that adversaries will reverse engineer a patch, discover the vulnerability and use it against unpatched systems? • Will enough USG information systems, U.S. businesses and/or consumers actually install the patch to offset the harm to security caused by educating attackers about the vulnerability? 1.D. Mitigation Considerations 13 UNCLASSIFIED • • • • • Can the product be configured to mitigate this vulnerability? Do other mechanisms exist to mitigate the risks from this vulnerability? Are impacts of this vulnerability mitigated by existing best-practice guidance, standard configurations, or security practices? If the vulnerability is disclosed, how likely is it that the vendor or another entity will develop and release a patch or update that effectively mitigates it? If a patch or update is released, how likely is it to be applied to vulnerable systems? How soon? What percentage of vulnerable systems will remain forever unpatched or unpatched for more than a year after the patch is released? Can exploitation of this vulnerability by threat actors be detected by USG or other members of the defensive community? Part 2 – Intelligence, Law Enforcement, and Operational Equity Considerations 2.A. Operational Value Considerations • Can this vulnerability be exploited to support intelligence collection, cyber operations, or law enforcement evidence collection? • What is the demonstrated value of this vulnerability for intelligence collection, cyber operations, and/or law enforcement evidence collection? • What is its potential (future) value? • What is the operational effectiveness of this vulnerability? 2.B. Operational Impact Considerations • Does exploitation of this vulnerability provide specialized operational value against cyber threat actors or their operations? Against high-priority National Intelligence Priorities Framework (NIPF) or military targets? For protection of warfighters or civilians? • Do alternative means exist to realize the operational benefits of exploiting this vulnerability? • Would disclosing this vulnerability reveal any intelligence sources or methods? Part 3 – Commercial Equity Considerations • If USG knowledge of this vulnerability were to be revealed, what risks could that pose for USG relationships with industry? Part 4 – International Partnership Equity Considerations • If USG knowledge of this vulnerability were to be revealed, what risks could that pose for USG international relations? 14