NSA and Director of National Intelligence Sued for Zero Day Disclosure ProcessGovernment Needs to Reveal Decision-Making Process for Publicizing Vulnerabilities The Electronic Frontier Foundation (EFF) today filed a Freedom of Information Act (FOIA) lawsuit against the NSA and the Office of the Director of National Intelligence (ODNI) to gain access to documents showing how intelligence agencies choose whether to disclose software security flaws known as zero days. A zero day is a previously unknown security vulnerability in software or online services that a researcher has discovered, but the developers have not yet had a chance to patch. A thriving market has emerged for these zero days; in some cases governmentsincluding the United Stateswill purchase these vulnerabilities, which they can use to gain access to targets computers. In April 2014, Bloomberg News published a story alleging that the NSA had secretly exploited the Heartbleed bug in the OpenSSL cryptographic library for at least two years before the public learned of the devastating vulnerability. The government strongly denied the report, claiming it had a developed a new Vulnerability Equities Process for deciding when to share vulnerabilities with companies and the public. The White Houses cybersecurity coordinator further described in a blog post that the government had established principles to guide agency decision-making including a disciplined, rigorous and high-level decision-making process for vulnerability disclosure. But the substance of those principles has not been shared with the public. EFF filed a FOIA request for records related to these processes on May 6 but has not yet received any documents, despite ODNI agreeing to expedite the request. Over the last year, U.S. intelligence-gathering techniques have come under great public scrutiny. One controversial element has been how agencies such as the NSA have undermined encryption protocols and used zero days. While an intelligence agency may use a zero day it has discovered or purchased to infiltrate targeted computers or devices, disclosing its existence may result in a patch that will help defend the public against other online adversaries, including identity thieves and foreign governments that may also be aware of the zero day. Since these vulnerabilities potentially affect the security of users all over the world, the public has a strong interest in knowing how these agencies are weighing the risks and benefits of using zero days instead of disclosing them to vendors, Global Policy Analyst Eva Galperin said. For the complaint: Andrew Crocker 