The following podcast contains advertising to access an ad-free version of the LawFair

podcast become a material supporter of LawFair at patreon.com slash LawFair, that's patreon.com slash

LawFair. Also check out LawFair's other podcast offerings, rational security, chatter, LawFair

no bull and the aftermath. So a bunch of organizations that have often

submissions are getting access to the information that is now being mandatoryly collected through

this new MIT database. And so there's a lot of content to visualize and imagine, but the

short version is there used to be voluntary disclosure. You used to be able to support

the intelligence services if you wanted to. And under the new system, if you're doing research

on software vulnerabilities in China, you are unfortunately in de facto supporting those

often submissions, even if you did not intend to. I am Eugenia Dachsire, LawFair's fellow

in technology policy law. And this is the LawFair podcast October 19, 2023. In July 2021,

the Chinese government published its regulations on the management of network product security

vulnerabilities. These roles require researchers to inform the government of all flaws and

code within 48 hours of their discovery, effectively supporting efforts to stockpile software

vulnerabilities, which can then be used for offensive cyber operations. My two guests

recently authored a report on how China manages software vulnerabilities. Dakota Kairi is

a non-resident fellow at the Atlantic Council's Global China Hub, and a consultant at Krav

Stamos Group. Kristen Lil-Rozzo is a public sector field CTO at IT security company Sofos.

We talked about how companies have adjusted to China's new rules, how their system compares

to the U.S. voluntary approach, and the incentives to collect vulnerabilities for offensive

operations. It's the LawFair podcast for October 19, China's approach to software vulnerabilities

reporting. You recently published a report called

...