Obama administration backs disclosing software vulnerabilities in most cases
The administration of U.S. President Barack Obama favors disclosing to the public vulnerabilities in commercial and open source software in the national interest, unless there is a national security or law enforcement need, the country’s spy agency said.
The government was on Friday countering a news report that said the U.S. National Security Agency knew about the recently identified Heartbleed vulnerability for at least two years and had used it for surveillance purposes. The administration said the NSA was not aware of Heartbleed until it was made public in a private sector cybersecurity report.
“When Federal agencies discover a new vulnerability in commercial and open source software—a so-called ‘Zero day’ vulnerability because the developers of the vulnerable software have had zero days to fix it—it is in the national interest to responsibly disclose the vulnerability rather than to hold it for an investigative or intelligence purpose,” the Office of the Director of National Intelligence said in a statement Friday.
