NSA and disclosure of CVE-2020-0601

Jurre van Bergen filed this request with the National Security Agency of the United States of America.
Tracking #

108841

Due March 16, 2020
Est. Completion None
Status
Awaiting Response

Communications

From: Jurre van Bergen


To Whom It May Concern:

Pursuant to the Freedom of Information Act, I hereby request the following records:

All documents related in whole or in part to the detailing the disclosure of CVE-2020-0601, a Microsoft security issue in Crypt32.dll in various versions of their Windows product. The security vulnerability was allegedly found and reported to Microsoft by the NSA.

The NSA disclosed it through the following channels, detailed here: https://twitter.com/NSAGov/status/1217152211056238593 & https://media.defense.gov/2020/Jan/14/2002234275/-1/-1/0/CSA-WINDOWS-10-CRYPT-LIB-20190114.PDF

Any of those documents could be but not limited to, notes, e-mails, media talking points, communication with Microsoft, as well as any records sharing details with other U.S government agencies about the vulnerability and communication with U.S Cert.

If you regard these documents as potentially exempt from disclosure requirements, I request that you nonetheless exercise your discretion to disclose them.Please release all reasonably segregable nonexempt portions of documents.

The requested documents will be made available to the general public, and this request is not being made for commercial purposes.

In the event that there are fees, I would be grateful if you would inform me of the total charges in advance of fulfilling my request. I would prefer the request filled electronically, by e-mail attachment if available or CD-ROM if not.

Thank you in advance for your anticipated cooperation in this matter. I look forward to receiving your response to this request within 20 business days, as the statute requires.

Sincerely,

Jurre van Bergen

From: National Security Agency

An acknowledgement letter, stating the request is being processed.

From: National Security Agency

Good Morning,

This further responds to your Freedom of Information Act (FOIA) request of DATE, for SUBJECT. Your request has recently been assigned for processing from our initial backlog. Before we continue processing your request, we want to establish your continued interest.

Please advise this office within 30 days of the date of this email of your continued interest. You may advise us by facsimile at 443-479-3612, in writing to National Security Agency, ATTN: FOIA Office (P132), 9800 Savage Road STE 6932, Ft. George G. Meade, MD 20755-6932, or via email at FOIARSC@nsa.gov. In any instance, please reference the Case Number 82062. If no response is received by the end of the 30 days, we will assume that you are no longer interested in pursuing the request, and we will administratively close your case with no further processing.

Thank you,
FOIA Customer Representative

From: Jurre van Bergen

Yes, please continue processing.

From: National Security Agency

Dear Mr. Bergen:

We received your inquiry for a status update on your case 108841. The NSA Freedom of Information Act (FOIA)/Privacy Act (PA) division treats all FOIA requesters fairly by responding to each on a first-in, first-out basis in accordance with federal regulations. Each request is unique; as such, there is no set timeframe for this process. Each case that has responsive records goes through three levels of review prior to the final response. The length of review in each phase depends on many factors, such as the number of pages and classification level.
Please be advised that there are a significant number of FOIA requests ahead of yours in the FOIA backlog queue, such that we are unable to provide an estimated date of completion at this time. A letter will be sent from the NSA FOIA/PA division once a case moves to the next phase of processing.
NSA Freedom of Information Division
(301) 688-6527

Files

pages

Close