The Coverage Gap: Chile's Cyber Disclosure Framework versus the USA, EU and UK

Technical Summary: The Coverage Gap in Chile's Cyber Disclosure Framework

Problem Statement
The paper addresses a critical disconnect between Chile's newly established legal framework for critical infrastructure protection and its operational reality. Following the promulgation of Ley 21.663 (Marco Nacional de Ciberseguridad) and the designation of 915 Operadores de Importancia Vital (OIVs) by the National Cybersecurity Agency (ANCI), a regulatory perimeter exists on paper. However, the paper identifies a "Coverage Gap": the measurable distance between the observable public exposure of these operators and their declared capability to coordinate vulnerability disclosures.

The core problem is that without a verifiable, machine-discoverable channel for reporting vulnerabilities, well-intentioned external researchers cannot responsibly report flaws. This forces a binary choice: leave vulnerabilities unmitigated or resort to ad-hoc, unreliable contact methods. The paper argues that Chile's critical infrastructure, having been targeted by sophisticated actors (including Lazarus Group-affiliated intrusions and regional APTs), currently lacks the operational substrate to receive and triage these reports, creating a high-risk environment where vulnerabilities may go unreported or fall into the grey market.

Methodology
The research employs a passive-only, Open Source Intelligence (OSINT) methodology designed to operate strictly within the bounds of Chilean computer-crimes law (Ley 21.459) and aligned with the principles of ISO/IEC 29147:2018.

1. Universe Definition: The study covers the full universe of 915 entities designated as OIVs under Resolución Exenta No 87 (December 2025), spanning ten sectors including energy, health, banking, and state administration.
2. Catalogue Construction: The authors developed and released anci-oiv-resolver, an open-source tool that maps the legal tax identifiers (RUTs) of OIVs to their public Internet identifiers (domains, mail exchangers). This tool covers approximately 98.7% of the official catalogue.
3. Audit Approach: The audit is strictly observational. It queries public sources (DNS, certificate transparency logs, HTTP headers, and /.well-known/ resources) without active probing, exploitation, or authentication.
4. Validation: A multi-layer validation pipeline suppresses false positives by biasing towards rejection in cases of ambiguity. This ensures that claims of vulnerability or misconfiguration are supported by high-confidence evidence, accepting a higher false-negative rate to protect against misattribution.
5. Statistical Rigor: Claims are stratified into three levels:
   • Level A: Universe-scale enumeration (e.g., sectoral distribution) derived from public records.
   • Level B: Universe-scale measurement of observable artifacts (e.g., email authentication misconfigurations).
   • Level C: Sample-based estimates generalized to the universe (e.g., software stack age), reported with Wilson 95% confidence intervals.

Key Contributions

1. Formalization of the "Coverage Gap": The paper defines the Coverage Gap as a three-layer framework:
   • Layer 1: Verifiable disclosure contact (e.g., security.txt per RFC 9116).
   • Layer 2: Public attack-surface visibility and documentation.
   • Layer 3: Observable disclosure-coordination capability (policy, response time, past behavior).
2. Universe-Scale Census: It provides the first full-universe measurement of disclosure capability for a Latin American critical infrastructure perimeter, benchmarking it against five other jurisdictions (USA, UK, EU, Netherlands, Denmark).
3. Open-Source Tooling: The release of anci-oiv-resolver enables independent researchers to reproduce the OIV-domain mapping, lowering the barrier for future audits and transforming the Chilean critical infrastructure perimeter from a research bottleneck into a "research commons."
4. Policy Roadmap: It proposes a four-stage, low-cost regulatory intervention model based on existing successful frameworks (CISA BOD 18-01, UK NCSC toolkit) that ANCI could enact within its current statutory authority.

Results
The audit reveals a severe systemic deficit in Chile's critical infrastructure posture:

• Layer 1 (Disclosure Contact): Only 1.7% (16 of 915) of OIVs publish a verifiable RFC 9116 disclosure channel. Notably, all four major banks and both telecommunications incumbents lack one entirely. Among physical-world infrastructure operators (energy, health, transport, etc.), fewer than ten have a channel.
• Email Authentication: 84% (766 of 915) of OIVs suffer from email-authentication misconfigurations (SPF, DKIM, DMARC). The most common issue is the publication of DMARC records with a p=none policy (monitoring only) or missing/broken records, leaving operators vulnerable to spoofing.
• Software Stack Age: An estimated 23.5% (95% CI [12%, 38%]) of the universe advertises end-of-life or known-vulnerable software stack components.
• Sectoral Disparities: The Banking & Finance sector exhibits the highest mean CVSS score (7.8) and a finding density exceeding its universe share. The Health sector also shows high finding density relative to its size.
• Cross-Jurisdictional Benchmarking: Chile lags significantly behind comparable jurisdictions. While the US, UK, and Netherlands achieved >95% Layer 1 coverage following binding mandates (e.g., CISA BOD 18-01), Chile sits at 1.7%. The paper estimates Chile is approximately eight years behind the US, UK, and Netherlands, and three years behind Denmark, on the dimension of email-authentication mandates.

Significance and Claims
The paper posits that the Coverage Gap is not a measure of how secure an operator is, but rather a measure of regulatory framework operationalization. A 98.3% gap at Layer 1 implies that for the vast majority of Chile's critical infrastructure, a vulnerability discovered by an external researcher has no defined path to remediation.

The authors claim that:

1. Regulation alone is insufficient: The existence of Ley 21.663 does not guarantee security; measurable, technical baselines (like disclosure channels and email authentication) are required to make the law effective.
2. The gap is an opportunity: The current "low-signal" environment (lack of active mass-targeting) provides a window to implement these controls before the infrastructure becomes a primary target for adversaries.
3. Remediation is feasible and low-cost: The paper argues that Chile does not need to invent new solutions. By adopting a DMARC mandate analogous to CISA BOD 18-01 and establishing a public disclosure registry, the Coverage Gap could be reduced from 98.3% to below 10% within 36 months.
4. Ethical Responsibility: The research is framed as a public good, designed to enable safe-harbour reporting and reduce the fraction of vulnerabilities that go unreported, while strictly adhering to ethical principles to avoid creating a "target list" for adversaries.

The paper concludes that the structural finding is not merely a technical deficiency but a failure of the regulatory framework to translate legal obligations into observable, operational capabilities. The proposed interventions aim to bridge this gap using established, proven mechanisms.