# New report on coordinated vulnerability disclosure in Canada

**URL:** <https://community.disclose.io/t/new-report-on-coordinated-vulnerability-disclosure-in-canada/251>\
**Category:** Write-ups and Disclosures\
**Created:** [July 19, 2021, 8:10pm UTC](https://community.disclose.io/t/new-report-on-coordinated-vulnerability-disclosure-in-canada/251 "2021-07-19T20:10:41Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Yuan](https://yyz2.discourse-cdn.com/flex028/user_avatar/community.disclose.io/yuan/32/279_2.png) [@Yuan](https://community.disclose.io/u/Yuan)\
**Post date:** [July 19, 2021, 8:10pm UTC](https://community.disclose.io/t/new-report-on-coordinated-vulnerability-disclosure-in-canada/251/1 "2021-07-19T20:10:41Z")

</div>

Hey folks!

**About me:** My name is Yuan (you-anne) Stevens and I’m a law & policy research based in Canada with experience working with Data & Society Research Institute in NYC on bug bounty programs (alongside Ryan Ellis of Northeastern — watch for our report coming out this fall) and have previously worked with with Gabriella Coleman, hacker expert & anthropologist at McGill University.

**Why I’m writing:** I’ve been a huge fan of the [disclose.io](http://disclose.io) community for a while now and am thrilled to share with y’all a report I co-authored, that looks at the state of coordinated vulnerability disclosure and anti-hacking laws in Canada:

> **[See Something, Say Something - The Dais](https://dais.ca/reports/vulnerability-disclosure/)**
>
> This report begins to identify both policy gaps and pragmatic solutions that can harness the skillset of security researchers and professionals who find and responsibly disclose security flaws in government websites, software, hardware, IoT devices,...

The report is called See _Something, Say Something: Coordinating the Disclosure of Vulnerabilities in Canada_ and the report was spearheaded by me and my team at the Ryerson Leadership Lab at Ryerson University, through a project called the Cybersecure Policy Exchange that’s co-led by another group (Rogers Cybersecure Catalyst) at the university as well.

In our report, we looked at how the Government of Canada handles vulnerability disclosure, comparing the country’s policies with members of the G20. We found that **many (60!) G20 members have distinct and clear policies for facilitating vulnerability disclosure — but Canada does not**. And Canada is also falling behind approaches in the US, and that are emerging in the UK, which generally promise to keep vulnerabilities disclosed through their VDP _separate_ from their “equities management” process.

On top of current anti-hacking laws, the **result could definitely discourage a good faith hacker from disclosing vulnerabilities to the government**.

I’d love to receive any constructive / helpful comments or feedback from folks in this community on our report — please don’t hesitate to reach out here or at yuan.stevens@ryerson.ca if you want to chat more! Grateful for folks’ time & eyes here.