II 

Calendar No. 335 

115TH CONGRESS 

2D SESSION S. 1281 

[Report No. 115–209] 

To establish a bug bounty pilot program within the Department of Homeland 

Security, and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

MAY 25, 2017 

Ms. HASSAN (for herself, Mr. PORTMAN, Mrs. MCCASKILL, Ms. HARRIS, and 

Mr. GARDNER) introduced the following bill; which was read twice and 

referred to the Committee on Homeland Security and Governmental Affairs 

FEBRUARY 26, 2018 

Reported by Mr. JOHNSON, with an amendment 

[Strike out all after the enacting clause and insert the part printed in italic] 

A BILL 

To establish a bug bounty pilot program within the 

Department of Homeland Security, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 


amozie on DSK30RV082PROD with BILLS
2 

•S 1281 RS

1 SECTION 1. SHORT TITLE. 

2 This Act may be cited as the ‘‘Hack the Department 

3 of Homeland Security Act of 2017’’ or the ‘‘Hack DHS 

4 Act’’. 

5 SEC. 2. DEPARTMENT OF HOMELAND SECURITY BUG BOUN6 TY PILOT PROGRAM. 

7 (a) DEFINITIONS.—In this section: 

8 (1) BUG BOUNTY PROGRAM.—The term ‘‘bug 

9 bounty program’’ means a program under which an 

10 approved computer security specialist or security re11 searcher is temporarily authorized to identify and re12 port vulnerabilities within the information system of 

13 the Department in exchange for cash payment. 

14 (2) DEPARTMENT.—The term ‘‘Department’’ 

15 means the Department of Homeland Security. 

16 (3) INFORMATION SYSTEM.—The term ‘‘infor17 mation system’’ has the meaning given the term in 

18 section 3502 of title 44, United States Code. 

19 (4) PILOT PROGRAM.—The term ‘‘pilot pro20 gram’’ means the bug bounty pilot program required 

21 to be established under subsection (b)(1). 

22 (5) SECRETARY.—The term ‘‘Secretary’’ means 

23 the Secretary of Homeland Security. 

24 (b) ESTABLISHMENT OF PILOT PROGRAM.— 

25 (1) IN GENERAL.—Not later than 180 days 

26 after the date of enactment of this Act, the SecVerDate Sep 11 2014 22:56 Feb 26, 2018 Jkt 079200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6401 E:\BILLS\S1281.RS S1281

amozie on DSK30RV082PROD with BILLS
3 

•S 1281 RS

1 retary shall establish a bug bounty pilot program to 

2 minimize vulnerabilities to the information systems 

3 of the Department. 

4 (2) REQUIREMENTS.—In establishing the pilot 

5 program, the Secretary shall— 

6 (A) provide monetary compensation for re7 ports of previously unidentified security 

8 vulnerabilities within the websites, applications, 

9 and other information systems of the Depart10 ment that are accessible to the public; 

11 (B) develop an expeditious process by 

12 which computer security researchers can reg13 ister with the Department, submit to a back14 ground check as determined by the Depart15 ment, and receive a determination as to ap16 proval for participation in the pilot program; 

17 (C) designate mission-critical operations 

18 within the Department that should be excluded 

19 from the pilot program; 

20 (D) consult with the Attorney General on 

21 how to ensure that computer security specialists 

22 and security researchers who participate in the 

23 pilot program are protected from prosecution 

24 under section 1030 of title 18, United States 


amozie on DSK30RV082PROD with BILLS
4 

•S 1281 RS

1 Code, and similar provisions of law for specific 

2 activities authorized under the pilot program; 

3 (E) consult with the relevant offices at the 

4 Department of Defense that were responsible 

5 for launching the 2016 ‘‘Hack the Pentagon’’ 

6 pilot program and subsequent Department of 

7 Defense bug bounty programs; 

8 (F) award competitive contracts as nec9 essary to manage the pilot program and for 

10 executing the remediation of vulnerabilities 

11 identified as a consequence of the pilot pro12 gram; and 

13 (G) engage interested persons, including 

14 commercial sector representatives, about the 

15 structure of the pilot program as constructive 

16 and to the extent practicable. 

17 (c) REPORT.—Not later than 90 days after the date 

18 on which the pilot program is completed, the Secretary 

19 of Homeland Security shall submit to the Committee on 

20 Homeland Security and Governmental Affairs of the Sen21 ate and the Committee on Homeland Security of the 

22 House of Representatives a report on the pilot program, 

23 which shall include— 


amozie on DSK30RV082PROD with BILLS
5 

•S 1281 RS

1 (1) the number of computer security research2 ers involved in the pilot program, broken down by 

3 the number of computer security researchers who— 

4 (A) registered; 

5 (B) were approved; 

6 (C) submitted security vulnerabilities; and 

7 (D) received monetary compensation; 

8 (2) the number and severity of previously un9 identified vulnerabilities reported as part of the pilot 

10 program; 

11 (3) the number of previously unidentified secu12 rity vulnerabilities remediated as a result of the pilot 

13 program; 

14 (4) the average length of time between the re15 porting of security vulnerabilities and remediation of 

16 the vulnerabilities; 

17 (5) the average amount of monetary compensa18 tion paid per unique vulnerability submitted under 

19 the pilot program and the total amount of monetary 

20 compensation paid to computer security researchers 

21 under the pilot program; and 

22 (6) the lessons learned from the pilot program. 

23 (d) AUTHORIZATION OF APPROPRIATIONS.—There 

24 are authorized to be appropriated to the Department 

25 $250,000 for fiscal year 2018 to carry out this Act. 


amozie on DSK30RV082PROD with BILLS
6 

•S 1281 RS

1 SECTION 1. SHORT TITLE. 

2 This Act may be cited as the ‘‘Hack the Department 

3 of Homeland Security Act of 2017’’ or the ‘‘Hack DHS 

4 Act’’. 

5 SEC. 2. DEPARTMENT OF HOMELAND SECURITY BUG BOUN6 TY PILOT PROGRAM. 

7 (a) DEFINITIONS.—In this section: 

8 (1) BUG BOUNTY PROGRAM.—The term ‘‘bug 

9 bounty program’’ means a program under which an 

10 approved individual, organization, or company is 

11 temporarily authorized to identify and report 

12 vulnerabilities of Internet-facing information tech13 nology of the Department in exchange for compensa14 tion. 

15 (2) DEPARTMENT.—The term ‘‘Department’’ 

16 means the Department of Homeland Security. 

17 (3) INFORMATION TECHNOLOGY.—The term ‘‘in18 formation technology’’ has the meaning given the term 

19 in section 11101 of title 40, United States Code. 

20 (4) PILOT PROGRAM.—The term ‘‘pilot program’’ 

21 means the bug bounty pilot program required to be 

22 established under subsection (b)(1). 

23 (5) SECRETARY.—The term ‘‘Secretary’’ means 

24 the Secretary of Homeland Security. 

25 (b) ESTABLISHMENT OF PILOT PROGRAM.— 


amozie on DSK30RV082PROD with BILLS
7 

•S 1281 RS

1 (1) IN GENERAL.—Not later than 180 days after 

2 the date of enactment of this Act, the Secretary shall 

3 establish, within the Office of the Chief Information 

4 Officer, a bug bounty pilot program to minimize 

5 vulnerabilities of Internet-facing information tech6 nology of the Department. 

7 (2) REQUIREMENTS.—In establishing the pilot 

8 program, the Secretary shall— 

9 (A) provide compensation for reports of pre10 viously unidentified security vulnerabilities 

11 within the websites, applications, and other 

12 Internet-facing information technology of the De13 partment that are accessible to the public; 

14 (B) award a competitive contract to an en15 tity, as necessary, to manage the pilot program 

16 and for executing the remediation of 

17 vulnerabilities identified as a consequence of the 

18 pilot program; 

19 (C) designate mission-critical operations 

20 within the Department that should be excluded 

21 from the pilot program; 

22 (D) consult with the Attorney General on 

23 how to ensure that approved individuals, organi24 zations, or companies that comply with the re25 quirements of the pilot program are protected 


amozie on DSK30RV082PROD with BILLS
8 

•S 1281 RS

1 from prosecution under section 1030 of title 18, 

2 United States Code, and similar provisions of 

3 law for specific activities authorized under the 

4 pilot program; 

5 (E) consult with the relevant offices at the 

6 Department of Defense that were responsible for 

7 launching the 2016 ‘‘Hack the Pentagon’’ pilot 

8 program and subsequent Department of Defense 

9 bug bounty programs; 

10 (F) develop an expeditious process by which 

11 an approved individual, organization, or com12 pany can register with the entity described in 

13 subparagraph (B), submit to a background check 

14 as determined by the Department, and receive a 

15 determination as to eligibility for participation 

16 in the pilot program; and 

17 (G) engage qualified interested persons, in18 cluding non-government sector representatives, 

19 about the structure of the pilot program as con20 structive and to the extent practicable. 

21 (c) REPORT.—Not later than 90 days after the date 

22 on which the pilot program is completed, the Secretary of 

23 Homeland Security shall submit to the Committee on 

24 Homeland Security and Governmental Affairs of the Senate 

25 and the Committee on Homeland Security of the House of 


amozie on DSK30RV082PROD with BILLS
9 

•S 1281 RS

1 Representatives a report on the pilot program, which shall 

2 include— 

3 (1) the number of approved individuals, organi4 zations, or companies involved in the pilot program, 

5 broken down by the number of approved individuals, 

6 organizations, or companies that— 

7 (A) registered; 

8 (B) were approved; 

9 (C) submitted security vulnerabilities; and 

10 (D) received compensation; 

11 (2) the number and severity of vulnerabilities re12 ported as part of the pilot program; 

13 (3) the number of previously unidentified secu14 rity vulnerabilities remediated as a result of the pilot 

15 program; 

16 (4) the current number of outstanding previously 

17 unidentified security vulnerabilities and Department 

18 remediation plans; 

19 (5) the average length of time between the report20 ing of security vulnerabilities and remediation of the 

21 vulnerabilities; 

22 (6) the types of compensation provided under the 

23 pilot program; and 

24 (7) the lessons learned from the pilot program. 


amozie on DSK30RV082PROD with BILLS
10 

•S 1281 RS

1 (d) AUTHORIZATION OF APPROPRIATIONS.—There are 

2 authorized to be appropriated to the Department $250,000 

3 for fiscal year 2018 to carry out this Act. 


amozie on DSK30RV082PROD with BILLS

amozie on DSK30RV082PROD with BILLS
Calendar No. 335 

115TH CONGRESS 

2D SESSION S. 1281 

[Report No. 115–209] 

A BILL 

To establish a bug bounty pilot program within the 

purposes. Department of Homeland Security, and for other 

FEBRUARY 26, 2018 

Reported with an amendment 


amozie on DSK30RV082PROD with BILLS