Tell software makers about flaws that government agencies find, instead of hiding them for attacks, except in rare cases
Steps to make it happen
- The government makes a rule that every time a national agency finds a software flaw, it must write it down in a record.
- A review board that includes outside experts decides whether to keep the flaw secret or tell the maker.
- Telling the maker is the normal choice, and any secret kept must come with a reason and a deadline.
- When the deadline comes, the board talks again about whether the flaw may stay secret.
- A maker that is told about a flaw must fix it within a set number of days.
- Each year the government tells the public how many flaws it found and how many it reported.
- Countries check with one another to see whether each one is following this rule.
- Flaws that are found get fixed fast, and it becomes normal for everyone to use the internet safely.
Water so far 💧 0
The proposal in detail
The rule covers flaws in software and devices that are not yet known to the public, whether public bodies such as intelligence agencies, the military and the police found them on their own or bought them from outside sellers. Because the makers have not noticed these flaws and have not fixed them, there is no way to defend against them if someone abuses them. Under this proposal, an agency must record a flaw as soon as it gets it and report it to an independent review board. The board would include not only security officials but also engineers, officials in charge of the economy and health care, and human rights experts, so that the decision is not made only for the convenience of one agency. The basic decision is to tell the maker, and keeping a flaw secret is allowed only when there is a specific and urgent need and no other way to meet it. Even then, the secret is given a short limit, for example a few months, and the case is reviewed again each time it is extended. For things where abuse would do great harm, such as hospital equipment, water and power control systems, and basic software used all over the world, no exceptions are allowed as a rule. The same rule applies to contracts for buying flaws from sellers, so an exclusive contract that forbids telling the maker cannot be signed. If a maker is told but does not fix the flaw, a warning can be made public after a set period. In the yearly report, the number of flaws, the fields they belong to, and how long they were held are published as a summary, and the details of each case are revealed only after the fix is done.
BenefitsFlaws get fixed sooner, and the whole society is better protected
The biggest effect is that the time until a flaw is fixed gets shorter, so criminals and hostile groups have fewer chances to abuse it. The agency that finds a flaw is not necessarily the only one that knows about it, and it is not unusual for someone else to find the same hole and use it. If it is fixed early, a country's own citizens and companies are protected, and so are the foundations of daily life, such as hospitals and water supplies. The danger is also smaller that attack tools stored by a government will be stolen or leak out and cause harm around the world. When the decision process and the number of cases are made public, accountability comes even to the field of national security, which tends to be wrapped in secrecy, and citizens find it easier to check what their government is doing. If governments stop joining the market for flaws as big buyers, prices stop being pushed up, and the growth of the black market is held back. If countries share the same way of thinking, they can predict one another's actions more easily, which also becomes a base for easing distrust and tension online.
DrawbacksA country may give up its own tools for investigation and defense
What opponents care about most is that the nation's security and its power to investigate would be weakened. Terrorist groups and serious criminal gangs use encrypted communication, and unknown flaws are one of the few ways to track them, but once a flaw is reported and fixed, it can never be used again. There is also the criticism that countries and criminal groups that do not follow this rule will keep stockpiling flaws, so only the countries that obey the rule have their hands tied, which is unfair. Bringing outsiders into the review board also raises the risk that secret information will spread, and decisions may take so long that they miss an urgent operation. However the standards and deadlines for exceptions are set, the line between what counts as an urgent need and what does not tends to be vague, and the review may turn out to be only for show. On the other hand, if the rules are too strict, agencies may stop reporting that a flaw exists at all, and there is a worry that flaws will be stockpiled out of sight instead. It also remains a big problem that there are few ways to check from outside whether countries keep their promises.
Learn the background
Today's society cannot run without software, from electronic medical records in hospitals to the controls of power plants. That software almost always has hidden flaws that even its makers have not noticed. Such unknown flaws are sold at high prices as keys for breaking into other people's computers, and some government agencies have been said to find or buy flaws for investigations, intelligence gathering and attacks, and to keep them to themselves without telling the makers. But a hidden flaw stays dangerous for everyone in the world who uses the same software. In fact, attack tools said to have been stored by a government agency have leaked out and been built into malicious programs that demand ransom, and hospitals, companies and government offices in many places have been shut down. Some countries have procedures for deciding whether to hide a flaw or report it, but in many cases the contents are not public, and the standards differ from country to country. It is time to ask again whether a secret kept for protection is putting everyone in danger instead.
Choose them ready to accept their drawbacks too (up to 5)
It helps pay for the server and the AI's planting
This proposal was written in Japanese by AI (claude-opus-5-5, policy version 2026-10-15d) and translated by AI (claude-sonnet-5-5). Nobody has checked the facts. Read the original (日本語) How the AI writes