Sec. 608. Review of intelligence community participation in vulnerabilities equities process
375 words·~2 min read·
/bill/115/hr/3180/ih/section-608A research copy — for the controlling text, always check the official state or federal source. Not legal advice.
Not later than 180 days after the date of the enactment of this Act, the Inspector General of the Intelligence Community shall review, with respect to the 3-year period preceding the date of the review, the roles and responsibilities of the elements of the intelligence community in the process of the Federal Government for determining whether, when, how, and to whom information about a vulnerability that is not publicly known will be shared with or released to a non-Federal entity or the public.
Not later than 240 days after the date of the enactment of this Act, the Inspector General shall submit to the congressional intelligence committees a report on the results of the review under subsection (a). The report under paragraph
(1)shall include the following: A description of the roles and responsibilities of the elements of the intelligence community in the process of determining whether, when, how, and to whom information about a vulnerability that is not publicly known will be shared or released to a non-Federal entity or the public. The criteria used by the Federal Government, including elements of the intelligence community, in making such determination. With respect to the period covered by the review— a summary of vulnerabilities known to elements of the intelligence community that were reviewed by the Federal Government pursuant to such process, including— the number of vulnerabilities known to the intelligence community that were reviewed; and of such number of reviewed vulnerabilities, the number for which information was shared with or released to a non-Federal entity or the public; and an assessment of whether there were any vulnerabilities known to elements of the intelligence community that were not reviewed pursuant to such process, and if so, the basis and rationale for not conducting such a review. A description of any current mechanisms for overseeing such process. Recommendations to improve the efficiency, effectiveness, accountability, and, consistent with national security, transparency of such process. Any other matters the Inspector General determines appropriate. The report may be submitted in classified form. In this section, the term vulnerability means, with respect to information technology, a design, configuration, or implementation weakness in a technology, product, system, service, or application that can be exploited or triggered to cause unexpected or unintended behavior.