Law Enforcement Using and Disclosing Technology Vulnerabilities
Released: 2017-04-26T00:00:00

Summary: There has been increased discussion about law enforcement legally "hacking" and accessing certain information about or on devices or servers. Law enforcement has explored various avenues to discover and exploit vulnerabilities in technology so it may attempt to uncover information relevant to a case that might otherwise be inaccessible. For instance, as people have adopted tools to conceal their physical locations and anonymize their online activities, law enforcement reports that it has become more difficult to locate bad actors and attribute certain malicious activity to specific persons. As a result, officials have debated the best means to obtain information that may be beneficial to the administration of justice. Exploiting vulnerabilities is one such tool.

Law enforcement's use of tools that take advantage of technology vulnerabilities has evolved over the years. The first reported instances of law enforcement hacking involved authorities using keylogging programs to obtain encryption keys and subsequent access to devices. More recently, law enforcement has been relying on specially designed exploits, or network investigative techniques (NITs), to bypass anonymity protections of certain software. In addition, investigators have leveraged vulnerabilities discovered in software designed to encrypt or otherwise secure data and limit access to information.

In exploiting vulnerabilities, law enforcement may leverage previously known vulnerabilities that have not yet been patched. Alternatively, it may develop tools to detect and take advantage of previously unknown and undisclosed vulnerabilities. It is law enforcement's use and disclosure of these previously unknown vulnerabilities that has become the subject of some debate.

The Obama Administration established a process, known as the Vulnerabilities Equities Process (VEP), to help decide whether or not to disclose information about newly discovered vulnerabilities. The VEP is triggered whenever a federal government entity, including law enforcement, discovers or obtains a new hardware or software vulnerability. The discussion on whether the government, and law enforcement, should generally retain or disclose discovered vulnerabilities lacks a number of data points that may help inform the conversation. For example, in what number or proportion of cases does law enforcement leverage technology vulnerabilities to obtain evidence? Are there tools other than vulnerability exploits or NITs that law enforcement can use to obtain the same evidence, and how often are those tools utilized?

Congress may examine a range of policy issues related to law enforcement using and disclosing vulnerabilities. For example, how does law enforcement's ability to lawfully hack, or exploit vulnerabilities, influence the current debate surrounding whether law enforcement is "going dark," or being outpaced by technology? In addition, how does law enforcement acquire the knowledge of vulnerabilities and associated exploits? Might law enforcement consider establishing its own (or supporting others') reward programs in order to gain knowledge of vulnerabilities or exploits? Given the current VEP framework, is it the most effective method for law enforcement to use in determining whether to share vulnerability information with the technology industry, and how might law enforcement share such information with their multilateral law enforcement partners?


paragraphs: T here has been increased discussion about law enforcement legally "hacking" and accessing certain information on or about devices or servers. Officials conduct this hacking as part of criminal investigations and takedowns of websites that host illicit content or facilitate illegal activity. There have been reports of such hacking for more than a decade. 

Over the years, law enforcement has explored various avenues to discover and exploit vulnerabilities in technology so it may attempt to uncover information relevant to a case that might otherwise be inaccessible. For instance, as people have adopted tools to conceal their physical locations and anonymize their online activities, law enforcement reports that it has become more difficult to locate bad actors and attribute certain malicious activity to specific persons. As a result, officials have debated the best route to access information that may be beneficial to the administration of justice. Exploiting vulnerabilities is one such tool.

In exploiting vulnerabilities, law enforcement may take one of two broad paths to gain access to devices and information. It may rely upon known vulnerabilities that have not yet been patched, or it may develop tools to detect and use previously unknown and undisclosed vulnerabilities (or otherwise acquire exploits for these zero-day vulnerabilities) that it can then leverage.

Law enforcement's use of previously unknown vulnerabilities has become the subject of some debate. Policymakers have questioned law enforcement practices for maintaining versus disclosing these vulnerabilities. They have also questioned how maintaining or disclosing vulnerabilities may impact security—information security, public safety, and homeland security alike. This has opened a broader debate about whether law enforcement should disclose vulnerabilities and whether there should be rules for law enforcement behavior in this arena.

This report provides background on law enforcement's use of technology vulnerabilities in criminal investigations. It also provides information on the government's system by which agencies collectively determine whether to maintain or disclose newly discovered vulnerabilities. The report also outlines a range of policy issues that may arise regarding the use and disclosure of vulnerabilities in technology. 
subsections: section_title: Evolution of Law Enforcement Exploiting Vulnerabilities
paragraphs: The first reported instances of law enforcement hacking involved authorities using keylogging programs to obtain encryption keys and subsequent access to devices. For example, in a 1999 case against a Cosa Nostra mob boss the Federal Bureau of Investigation (FBI) physically installed a keylogger (using a technique that was classified at the time) on his computer to capture his encryption key and gain access to his computer. Several years later, in 2001, authorities started using a more advanced keylogger—one that could be installed remotely—named Magic Lantern. In addition to capturing keystrokes, Magic Lantern could record Internet browsing histories and usernames/passwords for sites.

More recently, law enforcement has been utilizing exploits to bypass protections of software such as Tor, which allows users to access websites anonymously. In addition, it has relied on vulnerabilities discovered in software that encrypts or otherwise secures data and limits access to information. While some investigations are known to have used specially designed exploits or malware, referred to as Network Investigative Techniques (NITs), others are merely suspected of using NITs to exploit vulnerabilities. The remainder of this section discusses examples of how the FBI has utilized exploits or malware over the years to facilitate its investigations.
subsections: section_title: Operation Torpedo
paragraphs: In 2011, the Netherlands' National High Tech Crime Unit began an investigation into child pornography websites hosted on the Dark Web. During the course of this investigation, they learned —and informed the FBI—that a server hosting one of these sites was located in Nebraska. The FBI then traced the server's IP address to Aaron McGrath, who they later arrested. They also seized the servers.

The FBI's affidavit supporting its search warrant application detailed the purpose of the NIT it proposed to use in its investigation. The FBI believed that the NIT was the "only available investigative technique with a reasonable likelihood of securing the evidence necessary to prove beyond a reasonable doubt the actual location and identity of those users" viewing certain pages of the child pornography websites administered by McGrath or sending/viewing private messages on those pages. 

The NIT was proposed to direct relevant computers accessing three specific child pornography websites to download instructions that would direct the computer to send certain information (computer identifying information, location, and user) back to the FBI. The FBI specified that the NIT would not hinder the use or functionality of impacted computers. 

Through the use of the NIT, the FBI reportedly collected IP addresses of at least 25 U.S. visitors to the child pornography websites. The FBI then subpoenaed the Internet Service Providers for the physical addresses of the computers associated with the IP addresses. The FBI was then able to make arrests around the country.

As experts have noted, this was "the first time—that we know of—that the FBI deployed such code broadly against every visitor to a website, instead of targeting a particular suspect."

section_title: Seizure of Freedom Hosting
paragraphs: In 2013, the FBI seized Freedom Hosting, a website hosting service operating on the Tor network that was reportedly home to more than 40 child pornography websites, as well as additional sites with no links to child pornography. When the FBI took control of the site, it infected it with "custom malware designed to identify visitors." This custom malware "exploited a Firefox security hole to cause infected computers to reveal their real IP addresses to the FBI." Specifically, the NIT targeted computers that accessed 23 specific websites on Freedom Hosting. It also targeted users of specific Tor Mail email accounts—a "free, anonymous e-mail service provider that operates as a 'hidden service' on the Tor network"—that investigators had linked to child pornography crimes.

Like in Operation Torpedo, the FBI's exploit against Freedom Hosting targeted all visitors to the associated websites—both illegal child pornography sites and legitimate businesses. As experts have noted, customers to the legitimate websites may have been impacted by the FBI's malware. Because the court documents have been sealed and the FBI has not discussed details of the exploit, it is unknown how many innocent individuals may have been "hooked" by the FBI's malware.

section_title: Operation Pacifier
paragraphs: The FBI conducted an investigation into a child pornography website known as Playpen, which was operating on the Dark Web and had nearly 215,000 members. Through the course of its investigation, the FBI determined that the computer server hosting Playpen was located in North Carolina. In February 2015, the FBI seized this server, and subsequently continued to run the website for nearly two weeks from a server in Virginia. In addition, a Virginia District Court judge authorized a search warrant allowing law enforcement to employ an NIT to try to identify actual IP addresses of computers used to access Playpen.

The NIT in the Playpen case sent a command to users' computers directing those computers to send certain information back to the FBI. This information included the computer's true IP address, a unique identifier that would distinguish it from other machines, and information on whether this computer had already received the NIT.

Through the use of the NIT, the FBI was able to uncover about 1,300 IP addresses and subsequently trace those to individuals. Criminal charges have been filed against more than 185 individuals. The FBI has declined to reveal the details of the NIT used against the Playpen website, and in at least one case has opted to dismiss charges rather than reveal the NIT source code. The FBI has also classified elements of the NIT, which, as experts have noted, impedes criminal discovery of the specific NIT source code.

section_title: Operation Onymous
paragraphs: In November 2014, the FBI and over 15 countries, operating through the European Cybercrime Center (EC3), launched Operation Onymous to investigate several Dark Web markets that traded in drugs, weapons, credit card information, fake documents, and computer hacking tools, among other things. Among the websites taken down in this operation was Silk Road 2, one of the most notorious online global bazaars for illicit services and contraband (mainly drugs). 

The Department of Justice (DOJ) noted that, "using court-authorized legal processes and Mutual Legal Assistance Treaty Requests, [international law enforcement] seized 400 online user addresses and multiple computer servers." These addresses could be accessed via Tor. However, authorities did not reveal how they bypassed security and anonymity protections offered by Tor and specifically stated they were keeping that information secret. Some speculate that the FBI may have paid Carnegie Mellon researchers for an exploit technique to take down certain dark websites. The FBI has not confirmed this, however, and has denied allegations that it paid $1 million to Carnegie Mellon for an exploit tool.

section_title: San Bernardino iPhone
paragraphs: In addition to exploiting vulnerabilities in websites and networks to obtain information about certain devices, law enforcement has also leveraged weaknesses in hardware and software to access content on certain devices. In the aftermath of the December 2, 2015, San Bernardino, CA, terrorist attack, investigators recovered an Apple iPhone belonging to one of the shooters. Law enforcement hoped that the device would contain valuable information on who the shooters may have been communicating with to plan the attacks, where the shooters may have traveled prior to the attack, and the potential involvement of others in the attack. However, after several months the FBI was still unable to access information on the device. The FBI requested through the courts that Apple assist investigators in accessing the data. Apple refused to comply. After a back and forth legal battle, the FBI ultimately found assistance from a third party entity, was able to access the contents of the phone, and dropped the case with Apple. Specifically, the FBI paid hackers to find a software flaw that the bureau was then able to leverage to ultimately crack into the iPhone. 

Researchers have noted that the FBI has not disclosed to Apple information about vulnerabilities in its operating system software that were discovered and used to get into the San Bernardino iPhone. Moreover, the FBI has noted that it cannot reveal the vulnerability to Apple because it did not purchase the rights to the technical details about the extent of the vulnerability or the method used to exploit the vulnerability. The FBI subsequently told Apple about a different flaw in software running on older versions of iPhones and Macs—a flaw that Apple reportedly had already patched in an update to its operating systems.

section_title: Vulnerabilities Equities Process: Administration Policy, Not Law
paragraphs: The Obama Administration established a process—known as the Vulnerabilities Equities Process (VEP)—to help decide whether or not to disclose information about a vulnerability that the government has discovered or otherwise obtained. The VEP was first set into motion through a presidential directive in 2008. An Executive Secretariat, run by the White House's National Security Council, oversees the VEP.
subsections: section_title: VEP Procedure
paragraphs: The VEP is triggered whenever a federal government entity, including law enforcement, discovers a new hardware or software vulnerability. The VEP specifies that the entity classify and/or designate the vulnerability for special handling. The vulnerability is then formally entered into the VEP if it is both newly discovered and not publicly known . 

When the vulnerability enters the VEP, the Executive Secretariat notifies the points of contact for all entities participating in the VEP. Any entity that determines it has equities at stake will send a subject matter expert to participate in discussions about the given vulnerability. These subject matter experts then collectively submit recommendations or options to the VEP Executive Review Board. Ultimately, the Executive Review Board decides how the federal government will respond to the vulnerability. Notably, there is an appeals process if any entity with equities at stake in the vulnerability disputes the Executive Review Board's decision.

section_title: VEP Decision Process
paragraphs: Since establishing the VEP, the government has noted that there are simultaneously benefits and challenges that arise from retaining and disclosing vulnerabilities. For instance, Michael Daniel, the former Cybersecurity Coordinator under President Obama, noted that on one hand, disclosing certain vulnerabilities may mean that officials "forego an opportunity to collect crucial intelligence that could thwart a terrorist attack[,] stop the theft of our nation's intellectual property, or even discover more dangerous vulnerabilities that are being used by hackers or other adversaries." On the other hand, "[b]uilding up a huge stockpile of undisclosed vulnerabilities while leaving the Internet vulnerable and the American people unprotected would not be in our national security interest." Daniel outlined a number of factors considered when determining whether the government will retain or disclose a vulnerability:

How much is the vulnerable system used in the core internet infrastructure, in other critical infrastructure systems, in the U.S. economy, and/or in national security systems?

Does the vulnerability, if left unpatched, impose significant risk?

How much harm could an adversary nation or criminal group do with knowledge of this vulnerability?

How likely is it that we would know if someone else was exploiting it?

How badly do we need the intelligence we think we can get from exploiting the vulnerability?

Are there other ways we can get it?

Could we utilize the vulnerability for a short period of time before we disclose it?

How likely is it that someone else will discover the vulnerability?

Can the vulnerability be patched or otherwise mitigated?

In 2014, President Obama noted that the government should generally reveal vulnerabilities so that they can be patched rather than preserving them for use, except in situations with "a clear national security or law enforcement need." It is unclear whether the Trump Administration will take a similar position on erring toward vulnerability disclosure rather than retention.

section_title: Retaining and Disclosing Vulnerabilities: Data
paragraphs: While the federal government has outlined a process that can be used for deciding whether or not to disclose a vulnerability, it has not provided clear data on how often this process is used and how many vulnerabilities it may retain at any given moment. In 2015, the National Security Agency (NSA) noted that "[h]istorically, the NSA has released more than 91 percent of vulnerabilities discovered in products that have gone through [its] internal review process and that are made or used in the United States." The NSA further noted that the remaining 9% of vulnerabilities it did not disclose were either patched by the relevant vendors or retained for national security purposes. The discussion has not included information on the total number of vulnerabilities uncovered and does not provide a reference for the total number of vulnerabilities disclosed through the process. Of note, the NSA used an internal review process prior to the establishment of the interagency VEP, so it is not clear whether use of the VEP has resulted in a similar proportion of newly discovered vulnerabilities being disclosed. It is also unclear whether federal law enforcement would disclose vulnerabilities at a rate similar to the NSA if it had its own process for vetting vulnerabilities to be retained or disclosed. Due to the nature of its investigations, law enforcement may be poised to exploit categorically different types of vulnerabilities than its foreign intelligence counterparts.

RAND researchers analyzed a dataset of more than 200 zero-day software exploits that it received from a vulnerability research group. RAND considers these data to be a proxy for the vulnerabilities that a "private use group" (e.g., government, defense contractor, exploit developer, or vulnerability researcher) may have. Looking at the stockpile of zero-day vulnerabilities, RAND's findings indicate that about 5.7% of them will have been discovered by an outside entity after a year. If these findings can be applied to other vulnerability stockpiles, one might extrapolate, for instance, that if the U.S. government has a similar stockpile of vulnerabilities, a similar proportion of them may be discovered by an outside group—including another nation state—after a year. 

RAND also determined that the average lifespan of a given vulnerability in its dataset was 6.9 years before it was patched or became publicly disclosed. In addition, 25% of the vulnerabilities only survived 1.5 years or less, while at the top end, 25% survived at least 9.5 years before being patched or publicly disclosed. As such, if these findings may be reliably applied to other vulnerabilities, law enforcement or another government entity may be able to retain or exploit a given vulnerability for about 9.5 years before it is patched or publicly disclosed. Of course, this lifespan may be influenced by factors such as the desirability—by researchers, nation states, criminals, or others—of finding a specific vulnerability. 

section_title: Using Known Vulnerabilities
paragraphs: The debate surrounding law enforcement use and disclosure of vulnerabilities generally circles around the exploitation of zero-day, or unknown and unpatched, vulnerabilities. However, law enforcement also relies upon known vulnerabilities to obtain certain information and evidence. These known vulnerabilities may be unpatched by software vendors. Additionally, the vulnerabilities may be patched by software vendors but users may continue to rely on outdated, unpatched versions of the technology. Some experts have suggested that a majority of hacking incidents involve such known vulnerabilities, and potentially "3/4 of hacking incidents occur through means that we know about and therefore have the opportunity to fix."

In some instances, Congress has mandated that certain vulnerabilities exist such that law enforcement may legally exploit these security flaws to obtain information. For instance, the 1990s brought "concerns that emerging technologies such as digital and wireless communications were making it increasingly difficult for law enforcement agencies to execute authorized surveillance." Congress passed the Communications Assistance for Law Enforcement Act (CALEA; P.L. 103-414 ) to help law enforcement maintain its ability to execute authorized electronic surveillance in a changing technology environment. Among other things, CALEA requires that telecommunications carriers assist law enforcement in intercepting electronic communications for which it has a valid legal order to carry out. Specifically, CALEA places capability requirements on telecommunications carriers mandating, among other things, that their system designs allow law enforcement to intercept wire and electronic communications and access call-identifying information. Essentially, the systems must be sufficiently unsecured such that content and call-identifying information can, given a lawful court order, be accessed by or provided to law enforcement.

There have been debates around expanding the range of built-in vulnerabilities that law enforcement may utilize. For instance, Congress has debated whether to require technology companies to build back door access points into encryption such that law enforcement, when presenting a lawful warrant, may access encrypted communications or stored data. This has been one of the most contentious points of debate in the larger policy discussion on the challenges that law enforcement may encounter from evolving technology. For more information on this issue, see the following text box. 

Officials and policymakers have largely moved away from the idea of introducing what could be exploitable vulnerabilities into technology. To date, research has not demonstrated that granting exceptional access—a means by which a vulnerability could be introduced and only accessed by legitimate, authorized actors—could be controlled such that only these authorized actors (e.g., law enforcement) may take advantage of it. One group of computer scientists and security experts, for instance, contends that providing for exceptional access "will open doors through which criminals and malicious nation-states can attack the very individuals law enforcement seeks to defend." 

section_title: Data Issues
paragraphs: The discussion on whether law enforcement should generally retain or disclose zero-day vulnerabilities that it discovers/obtains lacks a number of data points that may help inform this conversation, as well as other conversations on law enforcement's relationship with technology.

One primary question centers on the effectiveness of using, or exploiting, vulnerabilities. How "effective" are these NITs, or vulnerability exploits, in developing law enforcement cases? There are a number of arguments for and against why law enforcement should retain knowledge of vulnerabilities and, if available, their exploits. However, quantitative analysis of related questions is lacking. 

In what number—and proportion—of cases does law enforcement rely on technology vulnerabilities to obtain evidence? In cases involving evidence obtained through the use of NITs, was this evidence more crucial than other case evidence (not obtained through an NIT) to the investigation or prosecution? Are there tools other than NITs that law enforcement can use to obtain the same evidence, and how often are those tools utilized? How often do investigators decline to pursue a suspect or case because they cannot access communications or a device and do not have an exploit (and related vulnerability)? What is the financial cost of developing or purchasing vulnerability exploits? Once a vulnerability is discovered and an exploit is developed, how many times might a given exploit be used? What is the impact on "innocent bystanders"? Are NITs deployed narrowly enough to avoid implicating innocent individuals? Are the warrants authorizing use of NITs written narrowly enough to prevent innocent individuals from having their machines and information compromised? Can NITs introduce unintended weaknesses into the target machines/servers? Can they (and how often do they) unintentionally collect information beyond the scope of the intended target information?

section_title: Policy Issues
subsections: section_title: Lawful Hacking Intertwined with the Going Dark Debate
paragraphs: Within the broader going dark debate, "lawful hacking is often posited as an alternative to encryption regulation." Some experts have suggested that the U.S. government should continue to support strengthening encryption and simultaneously give law enforcement resources to bolster their capabilities to conduct investigations in an environment of evolving technology and strong encryption. Some have also noted that "if the executive branch is unable to successfully develop lawful hacking tools to address a sufficient amount of the need for government access to communications to meet the expectations of the general public, it becomes dramatically more likely that it will feel compelled to seek comprehensive legislative solutions mandating exceptional access." These hacking tools may include exploits for both publicly known and zero-day vulnerabilities.

The ability of law enforcement to take advantage of publicly known vulnerabilities may drive the conversation on going dark. If law enforcement is readily able to exploit these vulnerabilities, the question of whether it is going dark becomes less relevant. However, if law enforcement cannot take advantage of known vulnerabilities (for whatever reason), the question remains of whether it is being outpaced by the speed and strength of technology.

Law enforcement's use of zero-day vulnerabilities (those that it would submit to the vulnerabilities equities process), however, is a different issue. One question is whether the VEP, or any potential changes to the process, could affect law enforcement's reported going dark challenges. If the VEP generally results in disclosure of vulnerabilities, law enforcement might have a more limited timeframe in which it may develop exploits for, and take advantage of, a given vulnerability. On the other hand, if disclosure results in vendors patching these holes, malicious actors may be less likely to detect and exploit the vulnerabilities.

section_title: Law Enforcement Acquisition of Vulnerability Exploits
paragraphs: Law enforcement may acquire knowledge of vulnerabilities through a number of means; this information may be publicly available (such as that included in the National Vulnerability Database), obtained from a hacker or vulnerabilities marketplace, or discovered. Law enforcement may obtain exploits to take advantage of these vulnerabilities by purchasing them off-the-shelf (which may not be useful to law enforcement who need to customize them for legal use), including from an online marketplace. They may also develop exploits (or contract an outside entity to develop them) tailored to suit specific law enforcement needs.

Yet another unknown regarding the acquisition of zero-day vulnerabilities or exploits is whether other entities have or will discover the same vulnerability. As former White House cybersecurity coordinator Howard Schmidt noted, "[i]t's pretty naive to believe that with a newly discovered zero-day, you are the only one in the world that's discovered it ... [w]hether it's another government, a researcher or someone else who sells exploits, you may have it by yourself for a few hours or a few days, but you sure are not going to have it alone for long."

Acquiring the knowledge of vulnerabilities and their exploits can be costly. Some have suggested that the knowledge of vulnerabilities and their exploits can go for upwards of $1 million on the black or grey markets. RAND reports that the federal government may, however, spend more money assessing products for vulnerabilities and subscribing to vulnerability feeds than it spends on purchasing zero-day vulnerabilities and their exploits. If this is indeed the case, the latter choice could be more cost-effective for federal law enforcement, which operates within specific fiscal constraints. There has been speculation surrounding how much the FBI paid a company for the exploit to help obtain data from the phone of one of the shooters in the 2015 San Bernardino terrorist attack. Some have placed the price tag near $1 million. It is unclear how often federal law enforcement purchases information on vulnerabilities or their exploits, how much the average payment may be, or whether the acquired material can be applied to multiple investigations. Policymakers may explore federal law enforcement budgets for acquiring vulnerability knowledge and tools to exploit these holes.

section_title: Bug Bounties
paragraphs: Given that there will always be vulnerabilities, some may question whether there should be more attention given to preventing exploits of these vulnerabilities by strengthening security rather than to responding to exploits and deciding how to handle them. FBI Director Comey has noted that the government needs "to be more predictive, less reactive" and that this involves, in part, a focus on reducing vulnerabilities; the public and private sectors can use information on malicious actors and their techniques to strengthen potential targets and prevent cyber incidents. Some have suggested that "the U.S. government should create incentives for individuals, companies, and governments to find software vulnerabilities, publicize, and patch them, and thus reduce the risk of attack." Part of this may involve establishing or promoting "bug bounty" programs.

The concept of a bounty has long been used by law enforcement (and others) to obtain leads in identifying and locating suspects in crimes. For instance, the FBI runs a Most Wanted program, offering monetary rewards for information that leads to the identification or arrest of a suspect. Federal law enforcement could formalize a bug bounty program leading to information on vulnerabilities and their exploits. While this practice already occurs on an ad hoc basis, policymakers may debate whether a formalized process would be cost effective or fruitful. 

A number of companies have established internal bug bounty programs such that they can identify software vulnerabilities and patch them quickly. For example, Apple offers up to $200,000 for the identification of certain vulnerabilities, and this reward has been identified as one of the highest. Rewards such as these may incentivize some hackers to bring vulnerability knowledge directly to vendors or affected companies rather than to law enforcement. Bug bounty programs are also familiar to the federal government, as some agencies have already piloted them for their own systems. In April 2016, the Department of Defense (DOD) launched the "Hack the Pentagon" pilot program where "hackers were provided legal consent to perform specific hacking techniques against [DOD] websites, receiving financial awards for successfully submitting vulnerability reports."

While the federal government may expand its own bug bounty programs, another option that policymakers may consider is financially supporting private sector bug bounty programs through federal grants. There are a number of avenues through which various departments and agencies could provide assistance, and DOJ grants are one such angle. For one, DOJ could provide grants to support bug bounty programs at entities that share information on vulnerabilities with law enforcement. However, the success of such an initiative may be bounded by financial capabilities, as the federal government could have trouble competing with the high bug bounty rewards offered by the private sector. Grants could also be used to help entities establish internal bug bounty programs so that they would be better prepared to counter the efforts of hackers, criminals, and other malicious actors.

section_title: Sharing Vulnerabilities Information
paragraphs: With respect to vulnerabilities, two types of information sharing may be of particular interest to law enforcement. One involves sharing information with technology companies and the public, the other involves sharing information amongst law enforcement entities. 

The Vulnerabilities Equities Process (VEP), outlined above, is a primary means by which law enforcement may share information on zero-day vulnerabilities with the technology industry and public. In examining the VEP, policymakers may evaluate whether this is the most appropriate path by which law enforcement disseminates knowledge of previously unknown and unpatched vulnerabilities. 

Relatedly, policymakers may examine the issue of law enforcement disclosing details about NITs used to exploit vulnerabilities. There is no formalized or mandated process by which these tools may be evaluated for potential sharing. Law enforcement may view these details as sensitive and may even classify the tools used. Take, for instance, cases involving the Playpen website and the FBI's NIT that leveraged a vulnerability to help obtain identifying information of potential perpetrators. Even when requested in court, the FBI has declined to reveal the details of the NIT used against the Playpen website, and in at least one case has opted to dismiss charges rather than reveal detailed NIT source code. In addition, the FBI has classified elements of the NIT, which impedes criminal discovery—and thus potential public disclosure—of the specific NIT source code. Some have questioned whether revealing details about an NIT would provide insight into how law enforcement is utilizing it and whether—if a court has authorized a warrant for the use of an NIT—law enforcement has acted within the authorized scope of the warrant. Others have argued that details about an NIT would reveal information about the presence of a particular software vulnerability and how the NIT was deployed to a target computer. Policymakers may examine which entities should determine if and how NIT details should be revealed. Should this be decided by law enforcement, the courts, or Congress?

In sharing information on vulnerabilities and potential exploits with the larger law enforcement community, law enforcement may turn to the National Domestic Communications Assistance Center (NDCAC). The NDCAC, which opened in 2013, is led by the FBI and aimed at technical knowledge management and information sharing on technical solutions between federal, state, and local law enforcement agencies. Specifically, its four core functions are law enforcement coordination, industry relations, technology sharing, and CALEA implementation. The NDCAC may be an appropriate venue for law enforcement to share information on vulnerabilities and potential exploits that may be used to leverage these vulnerabilities. In the 114 th Congress, the Encryption Working Group recommended that Congress officially authorize and modernize the NDCAC to help bolster law enforcement's technical expertise.


Question-summary annotations: questions: question: What have discussions regarding law enforcement been focusing on recently?
answer: There has been increased discussion about law enforcement legally "hacking" and accessing certain information about or on devices or servers.

question: How have law enforcement groups utilized technology vulnerabilities?
answer: Law enforcement has explored various avenues to discover and exploit vulnerabilities in technology so it may attempt to uncover information relevant to a case that might otherwise be inaccessible.

question: Why have law enforcement agencies explored new methods of finding information?
answer: For instance, as people have adopted tools to conceal their physical locations and anonymize their online activities, law enforcement reports that it has become more difficult to locate bad actors and attribute certain malicious activity to specific persons.
child_questions: question: What has been the result of increased difficulties in obtaining information?
answer: As a result, officials have debated the best means to obtain information that may be beneficial to the administration of justice. Exploiting vulnerabilities is one such tool.

questions: question: How has law enforcement used technology over the years?
answer: Law enforcement's use of tools that take advantage of technology vulnerabilities has evolved over the years.
child_questions: question: What were the first uses of technology in hacking related to law enforcement?
answer: The first reported instances of law enforcement hacking involved authorities using keylogging programs to obtain encryption keys and subsequent access to devices.

question: How has technology usage changed in recent times?
answer: More recently, law enforcement has been relying on specially designed exploits, or network investigative techniques (NITs), to bypass anonymity protections of certain software.
child_questions: question: How are investigators using vulnerabilities in recent times?
answer: In addition, investigators have leveraged vulnerabilities discovered in software designed to encrypt or otherwise secure data and limit access to information.

questions: question: What is the purpose of the Vulnerabilities Equities Process?
answer: The Obama Administration established a process, known as the Vulnerabilities Equities Process (VEP), to help decide whether or not to disclose information about newly discovered vulnerabilities.

question: When is the VEP used?
answer: The VEP is triggered whenever a federal government entity, including law enforcement, discovers or obtains a new hardware or software vulnerability.

question: What could improve discussions related to retaining or disclosing vulnerabilities?
answer: The discussion on whether the government, and law enforcement, should generally retain or disclose discovered vulnerabilities lacks a number of data points that may help inform the conversation.
child_questions: question: What are some questions that could provide these answers?
answer: For example, in what number or proportion of cases does law enforcement leverage technology vulnerabilities to obtain evidence? Are there tools other than vulnerability exploits or NITs that law enforcement can use to obtain the same evidence, and how often are those tools utilized?