to the VEP and implemented it in 2014. So it could give the government a process for determining whether how and when to disclose vulnerabilities to technology companies so that they would be able to address those vulnerabilities and patch them. And in a couple situations, I know there was disclosure from the FBI in April of this year, the FBI informed Apple of a security flaw in older versions of iOS and OS 10. First vulnerability disclosure to Apple under the vulnerability equities process. In May of this year, the FBI cyber division warned the private sector about a fake USB device charger that can log the keystrokes of certain wireless keyboards. And that was 15 months after the FBI discovered the vulnerability. In the warning, the FBI stated, quote, if placed strategically in an office or other location where individuals might use wireless devices, a malicious cyber actor could potentially harvest personally identifiable information intellectual property, trade secrets, passwords, or other sensitive information, end quote. Other instances of the FBI using the VEP are scarce. And indeed, there have been reports that it's rare for the FBI to use this process. And so I wanted to ask you why this is and what's your view of the process? Thank you for that question. The process seems to me to be a reasonable process to, in a structured fashion, bring everybody who might have an optic on this in the government together to talk about how do we think about disclosing a particular vulnerability to the private sector as against the equities that may be at stake in terms of national security in particular. And so I think it makes sense to have such a process. The FBI participated in it when we come across a vulnerability that we know the vulnerability and that falls within the VEP's jurisdiction. I don't know the particulars of the case. You said there was a 15-month delay in disclosing a particular vulnerability. I don't know enough to react to that. Probably wouldn't react in an open forum in any event, but that's my overall reaction. And does every vulnerability discover go through this process in terms of understanding whether or not you would disclose? I think there's a definition of what falls under the process. You have to know the vulnerability. So we have to have knowledge of, so what is it that allows it? The vulnerability to be exploited. We didn't, for example, in the San Bernardino case. We bought access, but we didn't know the vulnerability what was behind it. But I forget the definition as I sit here of which vulnerabilities have to be considered. And so is there another process that you might use that's different from the VEP when you're looking at vulnerabilities and what are they? Before the VEP, I know our folks would routinely have making a disclosure to private entities, but I don't know of a process outside of VEP. And so, but you're not sure in every situation the VEP is used whenever you discover vulnerability. Sounds like a circular answer, but if it's, obviously, I didn't read the VEP before coming here today. We could get smart on it very quickly and have somebody talk to you about it. But if it falls in the definition of things that have to be discussed at the VEP, of course we do, I just can't remember what that definition is exactly. I'm trying to understand if a vulnerability is discovered, if there's always a standard process that you would go through to understand whether or not that information would be disclosed. And if that process is the VEP, that's the... Yeah, that's a great question. I don't know the answer to that, whether there's a set of vulnerabilities that would fall outside of the VEP process. And if that's the case, how do we deal with it? I don't know sitting here. Thanks. If you have other feedback on that, I'd appreciate it that another time. OK. In August, you said that stakeholders needed to take some time to collect information on the going dark issue and come back afterward to have an adult conversation. And I agree with you. And so, I wondered if you would agree that there's room for us to work together on ways to help law enforcement that don't include mandating a backdoor. Totally. I keep reading that I'm an advocate of backdoors. I want to mandate backdoors. I am not. I have never advocated. We have to have backdoors. We have to figure out how we can solve this problem together. And it has to be everybody who cares about it coming together to talk about it. I don't know exactly what the answer is, frankly. I can see the problem. So I think it's my job is to tell people the tools you're counting on us to use to keep you safe. They're less and less effective. That's a big problem. But what to do and how to do it is a really complicated thing. And I think everybody has to participate. Thank you. Thank you so much for that. And I yield back.