ID 

Union Calendar No. 752 

115TH CONGRESS 

2D SESSION S. 1281 

[Report No. 115–964] 

IN THE HOUSE OF REPRESENTATIVES 

APRIL 18, 2018 

Referred to the Committee on Homeland Security 

SEPTEMBER 25, 2018 

Reported with an amendment, committed to the Committee of the Whole 

House on the State of the Union, and ordered to be printed 

[Strike out all after the enacting clause and insert the part printed in italic] 

[For text of introduced bill, see copy of bill as introduced on April 18, 2018] 


pamtmann on DSKBFK8HB2PROD with BILLS
2 

•S 1281 RH

An Act 

To establish a bug bounty pilot program within the 

Department of Homeland Security, and for other purposes. 


pamtmann on DSKBFK8HB2PROD with BILLS
3 

•S 1281 RH

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Hack the Department 

5 of Homeland Security Act of 2018’’ or the ‘‘Hack DHS 

6 Act’’. 

7 SEC. 2. DEPARTMENT OF HOMELAND SECURITY BUG BOUN8 TY PILOT PROGRAM. 

9 (a) DEFINITIONS.—In this section: 

10 (1) BUG BOUNTY PROGRAM.—The term ‘‘bug 

11 bounty program’’ means a program under which— 

12 (A) individuals, organizations, and compa13 nies are temporarily authorized to identify and 

14 report vulnerabilities of appropriate information 

15 systems of the Department; and 

16 (B) eligible individuals, organizations, and 

17 companies receive compensation in exchange for 

18 such reports. 

19 (2) DEPARTMENT.—The term ‘‘Department’’ 

20 means the Department of Homeland Security. 

21 (3) ELIGIBLE INDIVIDUAL, ORGANIZATION, OR

22 COMPANY.—The term ‘‘eligible individual, organiza23 tion, or company’’ means an individual, organiza24 tion, or company that meets such criteria as the SecVerDate Sep 11 2014 23:44 Sep 25, 2018 Jkt 079200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6203 E:\BILLS\S1281.RH S1281

pamtmann on DSKBFK8HB2PROD with BILLS
4 

•S 1281 RH

1 retary determines in order to receive compensation in 

2 compliance with Federal laws. 

3 (4) INFORMATION SYSTEM.—The term ‘‘informa4 tion system’’ has the meaning given that term by sec5 tion 3502 of title 44, United States Code. 

6 (5) PILOT PROGRAM.—The term ‘‘pilot program’’ 

7 means the bug bounty pilot program required to be 

8 established under subsection (b)(1). 

9 (6) SECRETARY.—The term ‘‘Secretary’’ means 

10 the Secretary of Homeland Security. 

11 (b) ESTABLISHMENT OF PILOT PROGRAM.— 

12 (1) IN GENERAL.—Not later than 180 days after 

13 the date of enactment of this Act, the Secretary shall 

14 establish, within the Office of the Chief Information 

15 Officer, a bug bounty pilot program to minimize 

16 vulnerabilities of appropriate information systems of 

17 the Department. 

18 (2) REQUIREMENTS.—In establishing and con19 ducting the pilot program, the Secretary shall— 

20 (A) designate appropriate information sys21 tems to be included in the pilot program; 

22 (B) provide compensation to eligible indi23 viduals, organizations, and companies for re24 ports of previously unidentified security 


pamtmann on DSKBFK8HB2PROD with BILLS
5 

•S 1281 RH

1 vulnerabilities within the information systems 

2 designated under subparagraph (A); 

3 (C) establish criteria for individuals, orga4 nizations, and companies to be considered eligi5 ble for compensation under the pilot program in 

6 compliance with Federal laws; 

7 (D) consult with the Attorney General on 

8 how to ensure that approved individuals, organi9 zations, or companies that comply with the re10 quirements of the pilot program are protected 

11 from prosecution under section 1030 of title 18, 

12 United States Code, and similar provisions of 

13 law, and civil lawsuits for specific activities au14 thorized under the pilot program; 

15 (E) consult with the Secretary of Defense 

16 and the heads of other departments and agencies 

17 that have implemented programs to provide com18 pensation for reports of previously undisclosed 

19 vulnerabilities in information systems, regarding 

20 lessons that may be applied from such programs; 

21 and 

22 (F) develop an expeditious process by which 

23 an individual, organization, or company can 

24 register with the Department, submit to a backVerDate Sep 11 2014 23:44 Sep 25, 2018 Jkt 079200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6203 E:\BILLS\S1281.RH S1281

pamtmann on DSKBFK8HB2PROD with BILLS
6 

•S 1281 RH

1 ground check as determined by the Department, 

2 and receive a determination as to eligibility; and 

3 (G) engage qualified interested persons, in4 cluding non-government sector representatives, 

5 about the structure of the pilot program as con6 structive and to the extent practicable. 

7 (3) CONTRACT.—In establishing the pilot pro8 gram, the Secretary, subject to the availability of ap9 propriations, may award one or more competitive 

10 contracts to an entity, as necessary, to manage the 

11 pilot program. 

12 (c) REPORT.—Not later than 180 days after the date 

13 on which the pilot program is completed, the Secretary of 

14 Homeland Security shall submit to the Committee on 

15 Homeland Security and Governmental Affairs of the Senate 

16 and the Committee on Homeland Security of the House of 

17 Representatives a report on the pilot program, which shall 

18 include— 

19 (1) the number of individuals, organizations, or 

20 companies that participated in the pilot program, 

21 broken down by the number of individuals, organiza22 tions, or companies that— 

23 (A) registered; 

24 (B) were determined eligible; 

25 (C) submitted security vulnerabilities; and 


pamtmann on DSKBFK8HB2PROD with BILLS
7 

•S 1281 RH

1 (D) received compensation; 

2 (2) the number and severity of vulnerabilities re3 ported as part of the pilot program; 

4 (3) the number of previously unidentified secu5 rity vulnerabilities remediated as a result of the pilot 

6 program; 

7 (4) the current number of outstanding previously 

8 unidentified security vulnerabilities and Department 

9 remediation plans; 

10 (5) the average length of time between the report11 ing of security vulnerabilities and remediation of the 

12 vulnerabilities; 

13 (6) the types of compensation provided under the 

14 pilot program; and 

15 (7) the lessons learned from the pilot program. 

16 (d) AUTHORIZATION OF APPROPRIATIONS.—There are 

17 authorized to be appropriated to the Department $250,000 

18 for fiscal year 2019 to carry out this Act. 


pamtmann on DSKBFK8HB2PROD with BILLS
Union Calendar No. 752 

115TH CONGRESS 

2D SESSION S. 1281 

[Report No. 115–964] 

An Act 

To establish a bug bounty pilot program within the 

purposes. Department of Homeland Security, and for other 

SEPTEMBER 25, 2018 

Reported with an amendment, committed to the Comand ordered to be printed mittee of the Whole House on the State of the Union, 


pamtmann on DSKBFK8HB2PROD with BILLS