We the undersigned organizations, members of the Hacking Policy Council, respectfully request regulatory guidance from the Office of Foreign Assets Control (OFAC) regarding coordinated vulnerability disclosure processes and sanctions. We urge the Department to clarify organizations’ obligations when receiving a cybersecurity vulnerability disclosure from individuals in “comprehensively sanctioned” countries and regions, and the organization’s ability to ask follow-up questions regarding that vulnerability. Vulnerability disclosures are communications of information, without remuneration, performed to ensure and promote the security of information systems. We commend OFAC for stating in FAQ 448 that the “U.S. government supports efforts by researchers, cybersecurity experts, and network defense specialists to identify, respond to, and repair vulnerabilities that could be exploited by malicious actors.”1 We recognize that this is aligned with the broader U.S. government policy of reducing software vulnerabilities by promoting adoption of coordinated vulnerability disclosure processes in the public and private sectors.2It would be beneficial for OFAC to clarify that such communications from individuals in comprehensively sanctioned areas are not restricted and are exempt from sanctions.
Read Next
Japanese Regulator Balances Cybersecurity, Competition Concerns In MSCA Implementation Guidelines
Promoting robust competition in the digital space while ensuring cybersecurity protections is challenging. The Japan Fair Trade Commission strikes a crucial balance between these priorities in its May 2025 guidelines.
Protecting Mobile Security in a Competitive Ecosystem
In an amicus brief filed in Epic Games v. Apple Inc., the Center for Cybersecurity Policy and Law urges the 9th Circuit to ensure that competition remedies do not undermine security.
The Clock’s Ticking: Why CISA 2015 Must Be Renewed Now
As the September 2025 expiration of CISA 2015 looms, Congress faces a critical decision that will shape the future of national cyber defense. At a time when the U.S. is under near constant cyber attacks, government and industry need to share intel.