Protocol 1.0

Coordinated disclosure protocol

This protocol describes how Defocus will report and coordinate potential security issues concerning closed-loop neuromodulation systems. It is published in advance so that recipients can evaluate the process before deciding whether to engage.

Version
1.0
Issued
Last revised
DOI
Pending deposit

01 / Scope

Scope of a report

A report may address a condition that could affect the integrity, availability, or intended operation of sensing, decision, stimulation, update, or supporting communication functions. A report will distinguish observed behavior from inference and will identify the system versions and test conditions known to the researcher.

No report will include patient data. Testing will not intentionally interfere with clinical care or access a deployed device without authorization.

02 / Sequence

Order of contact

01

The manufacturer’s published product security or vulnerability disclosure channel will be contacted first.

02

If no suitable channel exists, the report will be sent to the manufacturer’s security, legal, or regulatory contact using a verifiable corporate address.

03

When coordination requires it, an appropriate national coordination body, regulator, or sector authority may be included. The manufacturer will be told when this occurs unless doing so would create a material safety risk.

03 / Contents

What the initial report contains

The initial report will contain enough information to support independent triage: an executive summary, affected product and version information if known, preconditions, reproducible steps or supporting evidence, potential consequence, and practical containment or remediation considerations. Sensitive technical material may be transferred through an agreed secure channel.

04 / Timeline

Coordination timeline

Receipt is requested within seven calendar days. A substantive triage response is requested within twenty-one calendar days. The default embargo is ninety calendar days from confirmed receipt of a sufficiently detailed report.

The publication date may move by written agreement when remediation is active and an extension meaningfully reduces risk. Earlier disclosure may be considered if there is credible evidence of active exploitation or imminent risk to patient safety. Any such decision will weigh the value of public warning against the risk created by technical detail.

05 / Escalation

If a report goes unanswered

A first follow-up will be sent after seven calendar days and a second after fourteen. If there is no substantive response within thirty calendar days, Defocus may request coordination from an appropriate national coordination body, regulator, or sector authority. The original ninety-day period continues unless another schedule is agreed in writing.

06 / Record

Publication and credit

Any public record will separate confirmed facts from unresolved questions, avoid operational detail that creates unnecessary risk, and note the coordination history. The manufacturer will receive a near-final technical draft for factual review before publication when circumstances allow. Factual review does not grant editorial control.

07 / Handling

Confidentiality and safe handling

Nonpublic materials will be limited to people and organizations needed for validation, remediation, or safety coordination. Defocus will consider reasonable confidentiality requests that are specific, time-limited, and compatible with public safety and an accurate research record.

08 / Contact

Contact

Potential reports and questions about this protocol should be directed to the address on the contact page. Please identify the message as a security disclosure when appropriate.