Governments have been telling the software industry to change programming languages. The NSA said it first, in a short advisory in November 2022. CISA and six partner agencies across five countries made the case for memory safe roadmaps in December 2023, and the White House Office of the National Cyber Director put the full argument in Back to the Building Blocks in February this year. The documents agree on the diagnosis: for large codebases in C and C++, memory-safety defects have sat around two-thirds of serious vulnerabilities for as long as anyone has counted. The fix that works is changing the language new code is written in, because forty years of training, tooling and standards have not made the old ones safe at scale.
None of these documents is law. They compel nothing, fine nobody and name no deadline. So it is fair to ask what a mandate that mandates nothing is for, and the answer is procurement. The documents exist to give buying organisations a sentence to put in a contract: show us your memory-safety roadmap. We made the longer version of that argument in procurement is an architecture: a requirement repeated across enough purchase orders behaves like regulation without ever being written as one.
What a mandate cannot do¶
It cannot rewrite the installed base, and the installed base is where the problem lives. The Linux kernel is tens of millions of lines of C. The TLS libraries, the image parsers, the PDF renderers and the baseband firmware that make up the actual attack surface of a working system are C and C++ almost without exception, maintained by teams sized for maintenance, not for rewrites. A document that said "rewrite it" would be waving at the tide.
The documents mostly do not say that, to their credit. The ask is a roadmap: new code in memory-safe languages, old code triaged by exposure, the riskiest parsing and privilege boundaries rewritten first. Systems programming was already moving that way before any government noticed, which is one reason the guidance has been received as pressure in a direction the field was already moving rather than as interference.
The evidence arrived from Android¶
Android has been the production experiment since 2019, and Google has published results along the way: by late 2022 the platform carried around 1.5 million lines of Rust with no memory-safety vulnerabilities found in them, and last month's five-year figures complete the picture. Memory-safety issues were 76% of the platform's vulnerabilities in 2019; they are 24% in 2024, while the old C and C++ sat largely unrewritten underneath.
The mechanism matters more than the headline. Vulnerability density decays with code age: most vulnerabilities are found in recent code, because recent code is where the churn is. Switch the language of new code and the payoff arrives years ahead of any rewrite schedule, because recent and actively modified code produces a disproportionate share of the new vulnerabilities. Everything the government documents ask rests on that observation, and Android is where it has been measured in production.
The honest residuals¶
Three things the mandate conversation keeps underweighting:
- The boundary moves, and concentrates. A Rust component calling a C
library through FFI, or using
unsafeblocks internally, has not eliminated the problem. At best it has gathered it into small, auditable regions, and that concentration happens only where the architecture enforces it. A large improvement when it holds, and a different claim from "memory safe". - Language share is an input, not an outcome. A roadmap can report the percentage of code in safe languages while the exploitable surface lives entirely in the remainder. The ONCD report is candid that measuring software quality is an open research problem, and until it is solved, the roadmaps will be measured by proxies.
- The two-thirds figure has a denominator. It counts memory-safety CVEs in C and C++ codebases. Logic errors, injection and authentication failures do not go away in Rust, as every language community rediscovers on its first big incident.
A forecast rather than a finding: the documents will age well, and not because anyone obeys them. The Android numbers make the roadmap argument on merit, procurement language will quietly make it binding, and in ten years the question "what is your memory-safety roadmap" will sound as unremarkable in a tender as "do you have backups" does today.