Tell software makers about flaws the government finds, instead of hiding them for attacks, except in rare cases
Steps to make it happen
- Every government office reports each software flaw it finds or buys to one official reporting desk.
- A review board with outside experts, not just secret security offices, talks about how dangerous each flaw is.
- As a rule, the government quickly tells the company that made the software about any flaw in widely used programs.
- The company makes a fix and sends an update to everyone's phones and computers.
- The government always tells makers about flaws in machines that run hospitals, water systems, and electric power, so they get fixed.
- If the government must keep a flaw secret, it writes down the reason and looks at the decision again after a set time.
- If the government learns that a secret flaw has reached bad people, it tells the company right away.
- Each year the government publishes how many flaws it told makers about and how many it kept secret, for anyone to see.
- Fixing a flaw first becomes the normal way of doing things around the world.
Water so far 💧 0
The proposal in detail
This proposal covers flaws in software and devices that are not yet known to the public and that government bodies, including intelligence agencies, the military, and the police, have found themselves or bought from outside. Because the makers have not noticed these flaws either, they can be used for attacks until they are fixed. Under the proposal, all such flaws are registered with a single desk, and an independent review board decides how each one is handled. The board includes not only the offices in charge of security but also private security experts, experts on privacy and human rights, and people from the offices in charge of the economy and industry, so that no single interest decides the outcome. The basic rule is disclosure: flaws in products that many people use are, as a rule, passed on to the makers so that they will fix them. Flaws in products that support the foundations of society, such as hospitals, water, electric power, and communications, may not be held back. If a flaw is kept temporarily as an exception, the reason and a deadline are recorded, and the flaw is reviewed again when the deadline arrives. If a flaw being held back leaks out, or there are signs that it is being abused, it is disclosed immediately. Every year the number of flaws disclosed and the number held back are published, and the detailed contents are reported, with secrecy kept, to the legislature and to an independent oversight body. Flaws bought from the markets that trade in them are covered by the same procedure, and countries set up a place to check one another's practices.
BenefitsMachines used by people everywhere become better protected
If flaws the government finds are passed on to makers, fixes come faster and people all over the world who use the same product are protected. The same software is used across borders, so fixing one flaw makes hospitals, schools, and small businesses safer in other countries as well as at home. The danger that a flaw held back will leak and cause great harm also goes down. By making the basic systems, such as hospitals and water, subject to disclosure without exception, the proposal makes clear that it aims to prevent harm that directly affects lives and daily living. Outside experts take part in the decisions and the numbers are published every year, which creates a degree of accountability even for the government's secret work and gives citizens more to think about when judging whether to trust it. Applying the same rules to buying flaws can also be expected to keep the government from becoming a big buyer in that market, pushing prices up and strengthening the motive to abuse flaws. If countries share the same way of thinking, it can also become a first step toward growing the minimum promises that should be kept in cyberspace.
DrawbacksThe government gives up tools it can use for investigation and defense
What those who oppose the proposal weigh most heavily is that it weakens the means of protecting the nation. For finding plans for terrorism or serious crime and for preparing against attacks from other countries, flaws not yet known to others are a limited and precious tool, and disclosure as the basic rule greatly reduces the chances to use them. In particular, if other countries ignore this rule and keep stockpiling flaws, only the countries that follow the rule could be put at a one-sided disadvantage. Adding outside experts to the review also opens more doors through which secrets can leak, and even publishing the numbers risks letting an opponent estimate what the government can do. If reviews take time, urgent decisions may be delayed. Moreover, with old devices whose makers no longer exist, or with control equipment that cannot be fixed quickly, telling someone about a flaw may not get it fixed, and the information spreading may even invite attacks. The proposal calls for a choice with no easy answer: deciding what to give up in order to protect what.
Learn the background
Today almost everything in society runs on software, from medical devices in hospitals and the controls of power plants and water treatment plants to bank transactions and the smartphones in our homes. Flaws that even the makers have not noticed almost always lie hidden in that software. Such flaws are valuable for investigating crimes, for spying on other countries, and as a means of striking back when the time comes, so a government that finds one sometimes keeps it to itself instead of telling the maker. But there are known cases in which a hidden flaw leaked out and was used in an attack that shut down computers in hospitals and companies around the world and demanded money. Enemies, friends, and a country's own citizens all use the same software, so hiding a flaw can also put a country's own people in danger. Some countries have a procedure for deciding whether to disclose or hold back, but its standards and results are mostly kept secret and are hard to check from outside. On top of that, markets that buy and sell flaws at high prices are growing. Society needs a way to check who is holding flaws, and why.
Choose them ready to accept their drawbacks too (up to 5)
It helps pay for the server and the AI's planting
This proposal was written in Japanese by AI (claude-opus-5-5, policy version 2026-10-15d) and translated by AI (claude-sonnet-5-5). Nobody has checked the facts. Read the original (日本語) How the AI writes