Protocol 1.0
Coordinated disclosure protocol
This protocol describes how Defocus will report and coordinate potential security issues concerning closed-loop neuromodulation systems. It is published in advance so that recipients can evaluate the process before deciding whether to engage.
01 / Scope
Scope of a report
A report may address a condition that could affect the integrity, availability, or intended operation of sensing, decision, stimulation, update, or supporting communication functions. A report will distinguish observed behavior from inference and will identify the system versions and test conditions known to the researcher.
No report will include patient data. Testing will not intentionally interfere with clinical care or access a deployed device without authorization.
02 / Sequence
Order of contact
The manufacturer’s published product security or vulnerability disclosure channel will be contacted first.
If no suitable channel exists, the report will be sent to the manufacturer’s security, legal, or regulatory contact using a verifiable corporate address.
When coordination requires it, an appropriate national coordination body, regulator, or sector authority may be included. The manufacturer will be told when this occurs unless doing so would create a material safety risk.
03 / Contents
What the initial report contains
The initial report will contain enough information to support independent triage: an executive summary, affected product and version information if known, preconditions, reproducible steps or supporting evidence, potential consequence, and practical containment or remediation considerations. Sensitive technical material may be transferred through an agreed secure channel.
04 / Timeline
Coordination timeline
Receipt is requested within seven calendar days. A substantive triage response is requested within twenty-one calendar days. The default embargo is ninety calendar days from confirmed receipt of a sufficiently detailed report.
The publication date may move by written agreement when remediation is active and an extension meaningfully reduces risk. Earlier disclosure may be considered if there is credible evidence of active exploitation or imminent risk to patient safety. Any such decision will weigh the value of public warning against the risk created by technical detail.
05 / Escalation
If a report goes unanswered
A first follow-up will be sent after seven calendar days and a second after fourteen. If there is no substantive response within thirty calendar days, Defocus may request coordination from an appropriate national coordination body, regulator, or sector authority. The original ninety-day period continues unless another schedule is agreed in writing.
06 / Record
Publication and credit
Any public record will separate confirmed facts from unresolved questions, avoid operational detail that creates unnecessary risk, and note the coordination history. The manufacturer will receive a near-final technical draft for factual review before publication when circumstances allow. Factual review does not grant editorial control.
07 / Handling
Confidentiality and safe handling
Nonpublic materials will be limited to people and organizations needed for validation, remediation, or safety coordination. Defocus will consider reasonable confidentiality requests that are specific, time-limited, and compatible with public safety and an accurate research record.
08 / Contact
Contact
Potential reports and questions about this protocol should be directed to the address on the contact page. Please identify the message as a security disclosure when appropriate.