Dakota Cary and Kristin Del Rosso at the Atlantic Council examined how China’s 2021 vulnerability rules feed the state’s offensive cyber apparatus. The regulations push all software-vulnerability reports to the Ministry of Industry and Information Technology (MIIT) before a patch is available. Independent researchers are prohibited from publishing information about vulnerabilities except to the company that owns the product. Companies doing business in China are required to submit notice of a software vulnerability within forty-eight hours of being notified of it. The result is near total collection of software vulnerabilities discovered in China. The rules were issued jointly by MIIT, the Cyberspace Administration of China and the Ministry of Public Security, took effect on 1 September 2021 and threaten suppliers that fail to fix or report a flaw with fines of up to CNY 500,000. Microsoft’s 2022 Digital Defense Report had already linked a rise in zero-day use by China-based actors to the law’s first full year in effect, warning that it “might” let the government weaponize what gets reported. Coordinated disclosure, just with an unusual coordinator.
