republic-os/legal/us/code/title-50/chapter-45/section-3316a.md

type, title, description, jurisdiction, corpus, kind, title_number, title_name, chapter_number, chapter_name, section, citation, status, release_point, release_date, source, source_url, source_identifier, source_file, source_hash, raw_snapshot_hash, text_hash, retrieved_at, confidence, tags

type	title	description	jurisdiction	corpus	kind	title_number	title_name	chapter_number	chapter_name	section	citation	status	release_point	release_date	source	source_url	source_identifier	source_file	source_hash	raw_snapshot_hash	text_hash	retrieved_at	confidence	tags
LegalText	50 U.S.C. § 3316a	Reports on intelligence community participation in vulnerabilities equities process of Federal Government	us	united_states_code	code_section	50	WAR AND NATIONAL DEFENSE	45	MISCELLANEOUS INTELLIGENCE COMMUNITY AUTHORITIES	3316a	50 U.S.C. § 3316a	current	119-100	2026-06-26	official	https://uscode.house.gov/download/releasepoints/us/pl/119/100/xml_usc50@119-100.zip	/us/usc/t50/s3316a	data/legal/raw/us/code/title-50/usc50.xml	631f18f35dae390b59b14a14d4f4c59cbb7b915ef4b1a7058b6380938409d6b1	708c288b5448617cab7b03b8011860274671c9aec56686858b910a06948cd7ac	2a8963ebd43299be005cf7aced47876c99f43364da3b7407168bada1919e7108	2026-07-04	official	legal us-code

50 U.S.C. § 3316a - Reports on intelligence community participation in vulnerabilities equities process of Federal Government

Text

(a) Definitions In this section:

(1) Vulnerabilities Equities Policy and Process document The term “Vulnerabilities Equities Policy and Process document” means the executive branch document entitled “Vulnerabilities Equities Policy and Process” dated November 15, 2017.

(2) Vulnerabilities Equities Process The term “Vulnerabilities Equities Process” means the interagency review of vulnerabilities, pursuant to the Vulnerabilities Equities Policy and Process document or any successor document.

(3) Vulnerability The term “vulnerability” means a weakness in an information system or its components (for example, system security procedures, hardware design, and internal controls) that could be exploited or could affect confidentiality, integrity, or availability of information.

(b) Reports on process and criteria under Vulnerabilities Equities Policy and Process (1) In general Not later than 90 days after December 20, 2019, the Director of National Intelligence shall submit to the congressional intelligence committees a written report describing—

(A) with respect to each element of the intelligence community—

(i) the title of the official or officials responsible for determining whether, pursuant to criteria contained in the Vulnerabilities Equities Policy and Process document or any successor document, a vulnerability must be submitted for review under the Vulnerabilities Equities Process; and

(ii) the process used by such element to make such determination; and

(B) the roles or responsibilities of that element during a review of a vulnerability submitted to the Vulnerabilities Equities Process.

(2) Changes to process or criteria Not later than 30 days after any significant change is made to the process and criteria used by any element of the intelligence community for determining whether to submit a vulnerability for review under the Vulnerabilities Equities Process, such element shall submit to the congressional intelligence committees a report describing such change.

(3) Form of reports Each report submitted under this subsection shall be submitted in unclassified form, but may include a classified annex.

(c) Annual reports (1) In general Not less frequently than once each calendar year, the Director of National Intelligence shall submit to the congressional intelligence committees a classified report containing, with respect to the previous year—

(A) the number of vulnerabilities submitted for review under the Vulnerabilities Equities Process;

(B) the number of vulnerabilities described in subparagraph (A) disclosed to each vendor responsible for correcting the vulnerability, or to the public, pursuant to the Vulnerabilities Equities Process; and

(C) the aggregate number, by category, of the vulnerabilities excluded from review under the Vulnerabilities Equities Process, as described in paragraph 5.4 of the Vulnerabilities Equities Policy and Process document.

(2) Unclassified information Each report submitted under paragraph (1) shall include an unclassified appendix that contains—

(A) the aggregate number of vulnerabilities disclosed to vendors or the public pursuant to the Vulnerabilities Equities Process; and

(B) the aggregate number of vulnerabilities disclosed to vendors or the public pursuant to the Vulnerabilities Equities Process known to have been patched.

(3) Nonduplication The Director of National Intelligence may forgo submission of an annual report required under this subsection for a calendar year, if the Director notifies the intelligence committees in writing that, with respect to the same calendar year, an annual report required by paragraph 4.3 of the Vulnerabilities Equities Policy and Process document already has been submitted to Congress, and such annual report contains the information that would otherwise be required to be included in an annual report under this subsection.

(4) Publication The Director of National Intelligence shall make available to the public each unclassified appendix submitted with a report under paragraph (1) pursuant to paragraph (2).

(Pub. L. 116–92, div. E, title LXVII, § 6720, Dec. 20, 2019, 133 Stat. 2230; Pub. L. 117–103, div. X, title III, § 307, Mar. 15, 2022, 136 Stat. 966.)

Notes

Editorial Notes

Amendments2022—Subsec. (c)(4). Pub. L. 117–103 added par. (4).

Statutory Notes and Related Subsidiaries

Definitions For definitions of “congressional intelligence committees” and “intelligence community” as used in this section, see section 5003 of div. E of Pub. L. 116–92, set out as a note under section 3003 of this title.