In 2017, a bipartisan group tried to enshrine the VEP into law with the PATCH Act—Protecting our Ability to Counter Hacking Act. The bill would mandate that any zero-days retained be periodically reevaluated and require annual reports to Congress and the public. PATCH stalled in the Senate but its sponsors say they plan to reintroduce it.
