The Equities Process is the process that GCHQ follows when making decisions regarding vulnerabilities found in technology.
Vulnerabilities can cause harm to UK security systems and those of our allies, but they may also enable the UK intelligence community to gather key information that helps to protect the country and its interests. This can include, for example, preventing terrorist attacks or identifying those involved in the sexual exploitation of children.
The term ‘equity’ refers to a vulnerability known to GCHQ and the ‘Equities Process’ is designed to ensure that GCHQ makes rational, evidence-based decisions about whether to retain or release vulnerabilities within technology. The decisions are based on whether there is a clear and overriding national security benefit in retaining the vulnerability.
The IPC initially took on oversight of the Equities Process on a non-statutory basis, at the request of the Director of GCHQ. The statutory basis for this oversight function was formalised by regulations which came into force on 8 December 2022.
For more information, please see the GCHQ website.