as Responsible Coordinated Disclosure. In this case, the CERT/CC works privately with the vendor to address the vulnerability before a public report is published, usually jointly with the vendor's own security advisory. In extreme cases when the vendor is unwilling to resolve the issue or cannot be contacted, the CERT/CC typically discloses information publicly after 45 days since first contact attempt. Software vulnerabilities coordinated by the CERT/CC may come from internal research or from outside reporting. Vulnerabilities discovered by outside individuals or organizations may be reported to the CERT/CC using the CERT/CC's Vulnerability Reporting Form. Depending on severity of the reported vulnerability, the CERT/CC may take further action to address the vulnerability and coordinate with the software vendor. Knowledge Base and Vulnerability Notes The CERT/CC regularly publishes Vulnerability Notes in the CERT KnowledgeBase. Vulnerability Notes include information about recent vulnerabilities that were researched and coordinated, and how individuals and organizations may mitigate such vulnerabilities. The Vulnerability Notes database is not meant to be comprehensive. Vulnerability Analysis Tools The CERT/CC provides a number of free tools to the security research community. Some tools offered include the following. CERT Tapioca—a pre-configured virtual appliance for performing man-in-the-middle attacks. This can be used to analyze network traffic of software applications and determine if the software uses encryption correctly, etc. BFF (Basic Fuzzer Framework)—a mutational file fuzzer for Linux FOE (Failure Observation Engine)—a mutational file fuzzer for Windows Dranzer—Microsoft ActiveX vulnerability discovery Training The CERT/CC periodically offers training courses for researchers, or organizations looking to establish their own PSIRTs. Controversies In the summer of 2014, CERT research funded by the US Federal Government was key to the de-anonymization of Tor, and information subpoenaed from CERT by the FBI was used to take down SilkRoad 2.0 that fall. FBI denied paying to deanonymize users, and CMU denied receiving funding for its compliance with the government's subpoena. Despite indirectly contributing to taking down numerous illicit websites and the arrest of at least 17 suspects, the research raised multiple issues: about computer security research ethics as a concern to the Tor community and others about being unreasonably searched online as related to the guarantee by the US 4th amendment about SEI/CERT acting at cross-purposes to its own missions, actions including withholding the vulnerabilities it had found from the software implementers and the public. CMU said in a statement in November 2015 that "...the university from time to time