Jay Healey - Feds and 0Days: From Before Heartbleed to After FBI Apple

### The National Security Dilemma of Zero-Day Vulnerabilities When government intelligence agencies, defense departments, or law enforcement entities discover or purchase zero-day software vulnerabilities, they face an acute national security dilemma: should they disclose the flaw to the software vendor to protect the entire digital ecosystem (defense), or should they retain and weaponize the vulnerability for foreign intelligence gathering and criminal investigations (offense)? In this presentation, Jason "Jay" Healey, senior research scholar at Columbia University's School of International and Public Policy (SIPA) and former White House director for cyber infrastructure protection, analyzes the opaque history, policy mechanisms, and reform efforts governing the U.S. government's Vulnerabilities Equities Process (VEP).

### Historical Evolution of U.S. Vulnerability Hoarding Healey traces the evolution of vulnerability policy across three decades: - **The Hoarding Era (1990s–2000s):** In early military cyber operations, the default posture was overwhelmingly offensive. Services like the Air Force, Navy, Army, and NSA hoarded zero-days in departmental silos, refusing to share discoveries even among sister agencies to protect exclusive operational capabilities. - **The Shift to Defense:** As critical infrastructure, the military, and the commercial economy became inextricably dependent on commercial software, policymakers realized that retaining unpatched vulnerabilities left American critical systems exposed to identical discovery by foreign adversaries. - **The Post-Snowden and Heartbleed Watershed:** Following the Snowden revelations and the 2014 Heartbleed vulnerability in OpenSSL—which sparked rumors of government foreknowledge—the Obama administration conducted an interagency review, culminating in presidential declarations establishing a formal presumption that vulnerabilities must be disclosed.

### Declassifying the Vulnerabilities Equities Process (VEP) Through Freedom of Information Act (FOIA) litigation by the Electronic Frontier Foundation (EFF), key government documents detailing the inner workings of the VEP were declassified: - **The Equities Review Board:** The charter established an interagency body comprising representatives from the NSA, CIA, FBI, Department of Defense, Department of Homeland Security, Department of Commerce, and Department of State. - **Subject Matter Expert Scoring:** Reviewers weigh conflicting national interests: the defensive risk to critical infrastructure, civil liberties, and commercial commerce if the flaw remains unpatched versus the intelligence value, exploitability, and availability of alternative collection methods if retained. - **Appeals and Redactions:** The declassified charters revealed structured procedural workflows and appeals mechanisms, proving that vulnerability decisions had transitioned from ad-hoc operational choices to institutionalized bureaucratic policy.

### Evaluating the NSA's 91 Percent Disclosure Metric Healey examines the controversial metric released by the NSA stating that historically, over 91% of vulnerabilities passing through its internal review were submitted to vendors for patching: - **Community Skepticism:** The hacker and security research community greeted this statistic with widespread skepticism, questioning whether the 9% retained accounted for the most critical, high-impact zero-days (such as zero-click remote code execution exploits). - **Scope Limitations:** Healey clarifies that the 91% statistic applied solely to the NSA's internal pipeline and excluded third-party commercial exploits purchased by other law enforcement agencies (such as the FBI's procurement of an iPhone bypass in the San Bernardino case). - **The Dual-Discovery Risk:** The speaker highlights empirical academic research demonstrating that independent, overlapping discovery of zero-days occurs far more frequently than intelligence agencies assume, meaning that every day a vulnerability is retained increases the probability of hostile discovery.

### Policy Recommendations for Transparency and Defensive Tilt The presentation concludes with strategic policy proposals to modernize national vulnerability management: - **Statutory Codification:** Healey advocates enshrining the VEP into federal law through congressional legislation, ensuring that future presidential administrations cannot unilaterally dismantle review requirements. - **Independent Oversight:** Recommending independent oversight mechanisms, including congressional reporting requirements and inspector general audits, to verify that non-defense agencies (like Commerce and DHS) retain genuine veto power against offensive retention. - **Systemic Defensive Tilt:** The speaker argues that given the overwhelming asymmetry of modern digital infrastructure, national security is vastly better served by securing the foundations of global software than by preserving transient offensive espionage advantages.

(AI summary — Gemini 3.8 Flash)