Dragon Tails: Supply-Side Security & International Vulnerability Disclosure Law
Atlantic Council researchers Stewart Scott and Trey Herr investigate global reliance on Chinese security research and the impact of China's mandatory disclosure laws.
Summary
Global Software Reliance on Chinese Vulnerability Research
Western proprietary and open-source software ecosystems historically relied heavily on security vulnerabilities discovered and disclosed by Chinese researchers.
Analyzing China's 2021 Vulnerability Regulations
Stewart Scott and Trey Herr examine China's Provisions on the Management of Network Product Security Vulnerabilities, which mandate reporting zero-days to the Ministry of Industry and Information Technology (MIIT) first.
Measuring the Supply-Side Shift in Zero-Day Disclosures
The researchers present quantitative data showing a steep drop in Chinese research contributions to international bug bounty platforms and Western CVE registries.
Geopolitical Consequences for Global Supply Chain Defense
The presentation evaluates policy responses for Western governments to foster domestic research talent and strengthen open-source software security.
Related talks
Main Stage·46 min
International cyber policy leaders discuss shared global challenges in software supply chain integrity, common vulnerability management, and multilateral defense.
Biohacking Village·29 min
Bill Hagestad
Examines military research facilities and biosecurity threat capabilities in the People's Republic of China.
AFK·42 min
Chris Rock examines the real-world methodologies, cyber operations, and infrastructure targets involved in modern government disruption.