Trump administration will shine light on VEP with public charter

Beyond providing a quantitative baseline for the VEP, the public charter will name the full roster of interagency leaders who weigh in on the process.

The Trump administration plans to launch a “public charter” to add transparency and clarity to the Vulnerabilities Equities Process (VEP), a policy that guides when and if the U.S. government will tell a software vendor about digital flaws they’ve discovered in their products that could be otherwise used for espionage or intelligence operations.

Rob Joyce, White House Cybersecurity Coordinator, provided details on the charter on Tuesday and Wednesday during two separate public speaking engagements. He said the VEP is largely misunderstood and that making part of the process public means explaining the considerations, rubric and individuals involved in the process.

“We are in the process of a policy decision-making group that’s reviewing it, endorsing it, and then we will be able to push it out,” Joyce said Wednesday at the Cambridge Cyber Summit about the charter. “What we’re trying to carefully weigh is having those capabilities, to be able to use them for national security, while at the same time making sure that it’s not a major liability for our economy, for the international community, for our national security.”

In an interview with CyberScoop, Joyce said the public charter would provide some new information concerning the number of vulnerabilities entered into the process each year compared to those ultimately disclosed back to the private sector.

The policy work behind the charter is still ongoing, and it’s not entirely clear yet how much context the government will eventually provide regarding the vulnerabilities mentioned.

“We went back and looked at it … and there are things that I think don’t need to be secret,” said Joyce, who previously led the NSA’s Tailored Access Operations unit before joining the White House.

Beyond providing a quantitative baseline for the VEP, the public charter will name the interagency leaders who weigh in on the process and what goes into these decisions, said Joyce. In addition, there will be an explanation for how the VEP is used bi-annually to continuously review certain vulnerabilities that remain withheld from companies.

Chris Inglis, former deputy director of the NSA, backed Joyce’s efforts to create a charter, telling CyberScoop it could help build trust, improve public awareness and possibly repair relations between D.C. and the tech sector.

“Now is the right time to do this .. especially after WannaCry and NotPetya,” said Inglis. “Increasingly the need for this sort of transparency is obvious and so I welcome it as long as it’s done correctly.”

Inglis mentioned that he supports the idea of providing a raw number for vulnerabilities reviewed via the VEP, but disproved of an approach that would disclose significant contextual information about the software flaws themselves — including, for example, the name of affected companies or systems impacted by each vulnerability.

“At a certain point, if there’s too much context, then it’s pretty easy to put the puzzle together,” Inglis said.

NSA officials have said in the past that the agency disclosed upwards of 90 percent of all vulnerabilities that went through the VEP. But questions loom over this high benchmark, given that very little is known about the process and whether loopholes exist which could allow for the hoarding of vulnerabilities.

The NSA is far from the only federal agency that discovers and leverages software vulnerabilities in U.S.-backed hacking operations. Other organizations involved in the practice, who are supposedly also responsible for respecting the VEP, includes U.S. Cyber Command, the FBI, DIA and CIA. These organizations are each tasked with acquiring intelligence about threats to the country.

There is currently no legal or administrative policy that compels agencies to adhere to the VEP.

In Mid-May, Senators Brian Schatz, D-Hawaii, Ron Johnson, R-Wis., and Cory Gardner, R-Colo., in addition to Representatives Ted Lieu, D-Calif., and Blake Farenthold, R-Texas, introduced the PATCH Act, a bill designed to codify the VEP into law. The PATCH Act, which had yet to pass either chamber, was intended to similarly shine a light on the VEP by explaining the criteria used, individuals involved and broader objective.

Schatz said he support’s Joyce’s decision to move forward with a public charter, although more needs to be done. He noted that Congress has an important role to play as well.

“While I’m encouraged that the [National Security Council] is taking steps towards making the Vulnerabilities Equities Process more transparent, we can’t stop there,” Schatz said in an emailed statement to CyberScoop. “We need more oversight from Congress, and we need to make sure the process doesn’t change with every administration. That’s why I worked with Senator Johnson on legislation to codify a stronger framework that would do just that.”

Where’s the Trump administration line on AI regulation?

The messy approach to U.S. AI regulation reflects both the rapid speed of model cyber capabilities and the White House’s “education” over the past two years, experts…

The White House says Section 702 is critical for cybersecurity, yet public evidence is sparse

Top cyber feds working toward fresh models of an old mantra: cyber collaboration

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure