115TH CONGRESS 

2D SESSION S. 1281 

AN ACT 

To establish a bug bounty pilot program within the 

Department of Homeland Security, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 
2 

†S 1281 ES

1 SECTION 1. SHORT TITLE. 

2 This Act may be cited as the ‘‘Hack the Department 

3 of Homeland Security Act of 2017’’ or the ‘‘Hack DHS 

4 Act’’. 

5 SEC. 2. DEPARTMENT OF HOMELAND SECURITY BUG BOUN6 TY PILOT PROGRAM. 

7 (a) DEFINITIONS.—In this section: 

8 (1) BUG BOUNTY PROGRAM.—The term ‘‘bug 

9 bounty program’’ means a program under which an 

10 approved individual, organization, or company is 

11 temporarily authorized to identify and report 

12 vulnerabilities of Internet-facing information tech13 nology of the Department in exchange for compensa14 tion. 

15 (2) DEPARTMENT.—The term ‘‘Department’’ 

16 means the Department of Homeland Security. 

17 (3) INFORMATION TECHNOLOGY.—The term 

18 ‘‘information technology’’ has the meaning given the 

19 term in section 11101 of title 40, United States 

20 Code. 

21 (4) PILOT PROGRAM.—The term ‘‘pilot pro22 gram’’ means the bug bounty pilot program required 

23 to be established under subsection (b)(1). 

24 (5) SECRETARY.—The term ‘‘Secretary’’ means 

25 the Secretary of Homeland Security. 

26 (b) ESTABLISHMENT OF PILOT PROGRAM.— 
3 

†S 1281 ES

1 (1) IN GENERAL.—Not later than 180 days 

2 after the date of enactment of this Act, the Sec3 retary shall establish, within the Office of the Chief 

4 Information Officer, a bug bounty pilot program to 

5 minimize vulnerabilities of Internet-facing informa6 tion technology of the Department. 

7 (2) REQUIREMENTS.—In establishing the pilot 

8 program, the Secretary shall— 

9 (A) provide compensation for reports of 

10 previously unidentified security vulnerabilities 

11 within the websites, applications, and other 

12 Internet-facing information technology of the 

13 Department that are accessible to the public; 

14 (B) award a competitive contract to an en15 tity, as necessary, to manage the pilot program 

16 and for executing the remediation of 

17 vulnerabilities identified as a consequence of the 

18 pilot program; 

19 (C) designate mission-critical operations 

20 within the Department that should be excluded 

21 from the pilot program; 

22 (D) consult with the Attorney General on 

23 how to ensure that approved individuals, orga24 nizations, or companies that comply with the 

25 requirements of the pilot program are protected 
4 

†S 1281 ES

1 from prosecution under section 1030 of title 18, 

2 United States Code, and similar provisions of 

3 law for specific activities authorized under the 

4 pilot program; 

5 (E) consult with the relevant offices at the 

6 Department of Defense that were responsible 

7 for launching the 2016 ‘‘Hack the Pentagon’’ 

8 pilot program and subsequent Department of 

9 Defense bug bounty programs; 

10 (F) develop an expeditious process by 

11 which an approved individual, organization, or 

12 company can register with the entity described 

13 in subparagraph (B), submit to a background 

14 check as determined by the Department, and 

15 receive a determination as to eligibility for par16 ticipation in the pilot program; and 

17 (G) engage qualified interested persons, in18 cluding non-government sector representatives, 

19 about the structure of the pilot program as con20 structive and to the extent practicable. 

21 (c) REPORT.—Not later than 180 days after the date 

22 on which the pilot program is completed, the Secretary 

23 of Homeland Security shall submit to the Committee on 

24 Homeland Security and Governmental Affairs of the Sen25 ate and the Committee on Homeland Security of the 
5 

†S 1281 ES

1 House of Representatives a report on the pilot program, 

2 which shall include— 

3 (1) the number of approved individuals, organi4 zations, or companies involved in the pilot program, 

5 broken down by the number of approved individuals, 

6 organizations, or companies that— 

7 (A) registered; 

8 (B) were approved; 

9 (C) submitted security vulnerabilities; and 

10 (D) received compensation; 

11 (2) the number and severity of vulnerabilities 

12 reported as part of the pilot program; 

13 (3) the number of previously unidentified secu14 rity vulnerabilities remediated as a result of the pilot 

15 program; 

16 (4) the current number of outstanding pre17 viously unidentified security vulnerabilities and De18 partment remediation plans; 

19 (5) the average length of time between the re20 porting of security vulnerabilities and remediation of 

21 the vulnerabilities; 

22 (6) the types of compensation provided under 

23 the pilot program; and 

24 (7) the lessons learned from the pilot program. 
6 

†S 1281 ES

1 (d) AUTHORIZATION OF APPROPRIATIONS.—There 

2 are authorized to be appropriated to the Department 

3 $250,000 for fiscal year 2018 to carry out this Act. 

Passed the Senate April 17, 2018. 

Attest: 

Secretary. 

115TH CONGRESS 

2D SESSION S. 1281 

AN ACT 

To establish a bug bounty pilot program within the 

purposes. Department of Homeland Security, and for other