White House names NSC's Grant Schneider to lead Vulnerability Equities Process board, which decides software vulnerabilities to keep secret for intel gathering
Context & Ripple Effects
This appointment puts a name on machinery the administration built only months earlier: the inter-agency rules published in November 2017 created the Vulnerability Equities Process charter, requiring annual review of any flaw kept secret for intelligence use, but left the question of who actually runs the board open. Naming NSC official Grant Schneider answers it — and concentrates the disclose-or-hoard decision inside the National Security Council rather than leaving it distributed across agencies.
The move also fits a longer arc of successive administrations formalizing cyber governance at the White House level, from Obama-era advisory panels drawing in figures like Keith Alexander to the later creation of the Cyber Safety Review Board to investigate failures like Log4j. The VEP chairmanship is an early instance of that pattern: standing White House structures replacing ad hoc agency practice.
First-order effects
- Vendors and researchers with disclosed flaws now face a single identified decision-maker at the NSC, giving the annual retention reviews required by the 2017 charter an accountable owner.
- Intelligence agencies seeking to keep exploits for offensive use must route their equities claims through a board chaired by a White House official, shifting leverage away from any single agency.
Second-order effects
- Software makers' patch timelines for unpatched flaws become hostage to the board's retention calls, making the NSC's internal deliberations a de facto input into enterprise security risk.
- A chaired, chartered process gives critics and oversight bodies a concrete target, raising pressure on the administration to publish how often it chooses secrecy over disclosure.
Third-order effects
- If the pattern holds, vulnerability equities decisions migrate from informal inter-agency bargaining toward institutionalized executive-branch governance — the same trajectory that later produced the Cyber Safety Review Board.
- Dual-use code intelligence — the same flaw as both an exploit and a defensive priority — becomes a permanent standing policy problem requiring dedicated White House machinery rather than case-by-case handling.
The trend: The White House is steadily converting ad hoc cyber decisions — which flaws to keep secret, which failures to investigate — into standing NSC-centered institutions, with the VEP chairmanship as an early data point.