“We are in the midst of trying to sort that out,” Comey said. “The threshold (for disclosure) is, are we aware of the vulnerability, or did we just buy a tool and don’t have sufficient knowledge of the vulnerability to implicate the process?”

“We are close to a resolution,” he added at a cybersecurity event at Georgetown University in Washington, D.C.

Get Data Sheet, Fortune’s daily technology newsletter

The White House has a procedure for reviewing technology security flaws and deciding which ones should be made public.

Comey suggested the audit may not apply in this high-profile circumstance.

Although officials say the process leans toward disclosure, it is not set up to handle or reveal flaws that are discovered and owned by private companies, sources have told Reuters, raising questions about the effectiveness of the so-called Vulnerabilities Equities Process.

Comey’s comments appeared to concede the FBI does not own the method used to crack the county-owned work phone belonging to Syed Farook, who with his wife opened fire in December on a San Bernardino, Calif., holiday party, killing 14 and wounding 22.

For more about Apple vs. FBI, watch:

The method instead belongs to a still-unidentified third party that the FBI said came forward due to the attention received from its public pursuit of a court order to compel Apple’s assistance in unlocking the phone.

Sources have told Reuters the technology used to access the phone data was supplied by a non-U.S. company.

Apple’s refusal to comply prompted a high-profile standoff and ignited a long-simmering debate over security and privacy and law enforcement access to encrypted technology.

The government withdrew its case after it said the secret hacking method worked.

Comey has previously said the method only works a “narrow slice” of iPhone 5c devices running iOS 9.