OTI Calls on Administration to Maintain Commitments in Vulnerabilities Equities Process

With today’s announcement that White House Cybersecurity Coordinator Rob Joyce will leave his position, New America’s Open Technology Institute (OTI) calls upon the Administration to maintain its commitment to transparency in implementing the Vulnerabilities Equities Process (VEP) charter released last November.

The VEP charter sets forth the process through which the government determines whether to disclose a cyber vulnerability so that it may be patched to protect cybersecurity, or to retain a vulnerability for exploitation by law enforcement or intelligence agencies. The release of the charter represented an important step forward in reducing the risks created by government exploitation of cyber vulnerabilities, and in the Administration’s commitment to providing transparency for this process. However, just one week ago White House Homeland Security Adviser Tom Bossert left his position, and the back-to-back departures create a risk that critical cybersecurity policies will not be robustly implemented. The first annual report examining implementation of the VEP will be due this fall, and the charter requires that it be written at the lowest classification level possible, with at least an unclassified executive summary. OTI has urged that Congress should codify the charter and incorporate further safeguards to ensure that sufficient weight is given to the security and privacy of ordinary consumers.

The following statement can be attributed to Sharon Bradford Franklin, Director of Surveillance and Cybersecurity Policy at the Open Technology Institute:

“It is critical that the government maintain a robust and transparent process for assessing cyber vulnerabilities, to protect the public’s cybersecurity and minimize the risks from government hacking. The Administration should fill the void in its cybersecurity team with experts who will fulfill the promises that were made with last fall’s release of the Vulnerabilities Equities Process charter. The annual report due this fall will be a test of the Administration’s commitment to transparency and to protecting the cybersecurity of the nation.”