To Disclose, or Not to Disclose, That Is the Question

This dissertation is the first publicly available methods-based approach to examining the previously classified Vulnerabilities Equities Process (VEP)—a federal level policy to adjudicate decisions on whether to retain or disclose newly discovered software vulnerabilities. Since its public acknowledgment in 2014, the benefits and shortcomings of the VEP have been sharply debated in the public arena by media, digital advocacy groups, and academia. The lack of publicly available data on the VEP, however, means that the majority of current public discourse is largely rooted in uninformed opinion. Two key aspects of this debate have focused on the design of the VEP charter itself, and the representation of equities considered during the vulnerability adjudication process. This dissertation analyzes the current VEP through a mixed methods approach and finds that—in both design and practice—it is deficient in its consideration of public-oriented equities and ethics that are important to software vulnerability-oriented public policy, directly impeding the current VEP's ability to promote social good through its adjudication process. I make eleven policy recommendations that address these deficiencies to support the VEP Director and Equities Review Board in making vulnerability adjudications that more robustly consider the equities of underrepresented stakeholders. This dissertation makes several original contributions to knowledge, including the development of a new virtue-based ethics framework for software vulnerability-oriented public policy. The development of this new framework not only fills a gap in the current literature, but also lays the foundation for further investigations into cyber policy and ethics—an under-researched yet critical nexus of modern life in a highly technology-dependent world.