Recailibrating the Use of Zero-Day Vulnerabilities

Authors

  • Kellen Carleton

DOI:

https://doi.org/10.5195/jlc.2023.270

Abstract

Zero-day vulnerabilities in critical software systems are of the highest priority for government agencies, black market hackers, and private software vendors. Each of these parties has different priorities and uses for zero-day vulnerabilities, but because of the global economy’s reliance on technology and software, they represent a significant threat to much of the critical infrastructure of the United States. The United States Intelligence Community is among one of the most sophisticated players in the zero-day market, and their decision making with respect to these unknown vulnerabilities has widespread impacts. This note examines the current state of the Vulnerabilities Equities Process, the executive branch policy designed to weigh various equities when determining the fate of a zero-day vulnerability discovered by the Intelligence Community; to use the zero-day to collect intelligence or to disclose the vulnerability and see that it is patched. I argue that the current Vulnerabilities Equities Process does not produce the most optimal outcomes, and that the decision making process must be ‘recalibrated’ to properly weigh all relevant equities and to ensure that zero-day vulnerabilities are not being used irresponsibly.

Downloads

Published

2024-05-07

How to Cite

Carleton, K. (2024). Recailibrating the Use of Zero-Day Vulnerabilities. Journal of Law and Commerce, 42(1). https://doi.org/10.5195/jlc.2023.270

Issue

Vol. 42 No. 1 (2023): Journal of Law and Commerce

Section

Notes

License

Copyright (c) 2024 Kellen Carleton

Creative Commons License

This work is licensed under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License.


Authors who publish with this journal agree to the following terms:

    1. The Author retains copyright in the Work, where the term “Work” shall include all digital objects that may result in subsequent electronic publication or distribution.

    2. Upon acceptance of the Work, the author shall grant to the Publisher the right of first publication of the Work.

    3. The Author shall grant to the Publisher and its agents the nonexclusive perpetual right and license to publish, archive, and make accessible the Work in whole or in part in all forms of media now or hereafter known under a Creative Commons 4.0 License (Attribution-Noncommercial-No Derivative Works), or its equivalent, which, for the avoidance of doubt, allows others to copy, distribute, and transmit the Work under the following conditions:
      1. Attribution—other users must attribute the Work in the manner specified by the author as indicated on the journal Web site;
      2. Noncommercial—other users (including Publisher) may not use this Work for commercial purposes;
      3. No Derivative Works—other users (including Publisher) may not alter, transform, or build upon this Work,with the understanding that any of the above conditions can be waived with permission from the Author and that where the Work or any of its elements is in the public domain under applicable law, that status is in no way affected by the license.

    4. The Author is able to enter into separate, additional contractual arrangements for the nonexclusive distribution of the journal's published version of the Work (e.g., post it to an institutional repository or publish it in a book), as long as there is provided in the document an acknowledgement of its initial publication in this journal.

    5. Authors are permitted and encouraged to post online a pre-publication manuscript (but not the Publisher’s final formatted PDF version of the Work) in institutional repositories or on their Websites prior to and during the submission process, as it can lead to productive exchanges, as well as earlier and greater citation of published work. Any such posting made before acceptance and publication of the Work shall be updated upon publication to include a reference to the Publisher-assigned DOI (Digital Object Identifier) and a link to the online abstract for the final published Work in the Journal.

    6. Upon Publisher’s request, the Author agrees to furnish promptly to Publisher, at the Author’s own expense, written evidence of the permissions, licenses, and consents for use of third-party material included within the Work, except as determined by Publisher to be covered by the principles of Fair Use.

    7. The Author represents and warrants that:

      1. the Work is the Author’s original work;
      2. the Author has not transferred, and will not transfer, exclusive rights in the Work to any third party;
      3. the Work is not pending review or under consideration by another publisher;
      4. the Work has not previously been published;
      5. the Work contains no misrepresentation or infringement of the Work or property of other authors or third parties; and
      6. the Work contains no libel, invasion of privacy, or other unlawful matter.
         
    8. The Author agrees to indemnify and hold Publisher harmless from Author’s breach of the representations and warranties contained in Paragraph 6 above, as well as any claim or proceeding relating to Publisher’s use and publication of any content contained in the Work, including third-party content.