We the undersigned organizations, members of the Hacking Policy Council, respectfully request regulatory guidance from the Office of Foreign Assets Control (OFAC) regarding coordinated vulnerability disclosure processes and sanctions. We urge the Department to clarify organizations’ obligations when receiving a cybersecurity vulnerability disclosure from individuals in “comprehensively sanctioned” countries and regions, and the organization’s ability to ask follow-up questions regarding that vulnerability. Vulnerability disclosures are communications of information, without remuneration, performed to ensure and promote the security of information systems. We commend OFAC for stating in FAQ 448 that the “U.S. government supports efforts by researchers, cybersecurity experts, and network defense specialists to identify, respond to, and repair vulnerabilities that could be exploited by malicious actors.”1 We recognize that this is aligned with the broader U.S. government policy of reducing software vulnerabilities by promoting adoption of coordinated vulnerability disclosure processes in the public and private sectors.2It would be beneficial for OFAC to clarify that such communications from individuals in comprehensively sanctioned areas are not restricted and are exempt from sanctions.

Read Next

Trump EO Aims to Streamline Critical Infrastructure Resilience

In a move aimed at decentralizing incident-preparedness and response, President Trump signed an EO seeking to streamline the feds role in responding to incidents, like cyber attacks, and place decision-makin with State and locals.

Cybersecurity Regulatory Harmonization Hearing Highlights Need for Public Private Sector Partnerships

Private sector representatives emphasized the importance of streamlining cybersecurity regulations and improving information sharing efforts between the government and industry during a recent House hearing.

Industry Coalition Urges Commerce Secretary Lutnick to Prioritize Funding NIST Cyber Efforts

A letter addressed to Commerce Secretary Howard Lutnick from a coalition of industry organizations emphasizes the urgent need to sustain funding and support for the National Institute of Standards and Technology’s cybersecurity mission.