HR 328 RFS
ment the VDP and complete security vulnerability 
remediation. 
(6) Any other information the Secretary deter-
mines relevant. 
SEC. 4. DEPARTMENT OF STATE BUG BOUNTY PILOT PRO-
GRAM. 
(a) ESTABLISHMENT OF PILOT PROGRAM.— 
(1) IN
GENERAL.—Not later than one year 
after the date of the enactment of this Act, the Sec-
retary shall establish a bug bounty pilot program to 
minimize security vulnerabilities of internet-facing 
information technology of the Department. 
(2) REQUIREMENTS.—In establishing the pilot 
program described in paragraph (1), the Secretary 
shall— 
(A) provide compensation for reports of 
previously unidentified security vulnerabilities 
within the websites, applications, and other 
internet-facing information technology of the 
Department that are accessible to the public; 
(B) award contracts to entities, as nec-
essary, to manage such pilot program and for 
executing the remediation of security vulnerabil-
ities identified pursuant to subparagraph (A); 
VerDate Sep 11 2014 
20:37 Jan 23, 2019
Jkt 089200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H328.RFS
H328
pamtmann on DSKBFK8HB2PROD with BILLS
HR 328 RFS
(C) identify which Department information 
technology should be included in such pilot pro-
gram; 
(D) consult with the Attorney General on 
how to ensure that individuals, organizations, 
or companies that comply with the requirements 
of such pilot program are protected from pros-
ecution under section 1030 of title 18, United 
States Code, and similar provisions of law for 
specific activities authorized under such pilot 
program; 
(E) consult with the relevant offices at the 
Department of Defense that were responsible 
for launching the 2016 ‘‘Hack the Pentagon’’ 
pilot program and subsequent Department of 
Defense bug bounty programs; 
(F) develop a process by which an ap-
proved individual, organization, or company can 
register with the entity referred to in subpara-
graph (B), submit to a background check as de-
termined by the Department, and receive a de-
termination as to eligibility for participation in 
such pilot program; 
(G) engage qualified interested persons, in-
cluding nongovernmental sector representatives, 
VerDate Sep 11 2014 
20:37 Jan 23, 2019
Jkt 089200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H328.RFS
H328
pamtmann on DSKBFK8HB2PROD with BILLS
HR 328 RFS
about the structure of such pilot program as 
constructive and to the extent practicable; and 
(H) consult with relevant United States 
Government officials to ensure that such pilot 
program complements persistent network and 
vulnerability scans of the Department of State’s 
internet-accessible systems, such as the scans 
conducted pursuant to Binding Operational Di-
rective BOD–15–01. 
(3) DURATION.—The pilot program established 
under paragraph (1) should be short-term in dura-
tion and not last longer than one year. 
(b) REPORT.—Not later than 180 days after the date 
on which the bug bounty pilot program under subsection 
(a) is completed, the Secretary shall submit to the Com-
mittee on Foreign Relations of the Senate and the Com-
mittee on Foreign Affairs of the House of Representatives 
a report on such pilot program, including information re-
lating to— 
(1) the number of approved individuals, organi-
zations, or companies involved in such pilot pro-
gram, broken down by the number of approved indi-
viduals, organizations, or companies that— 
(A) registered; 
(B) were approved; 
VerDate Sep 11 2014 
20:37 Jan 23, 2019
Jkt 089200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H328.RFS
H328
pamtmann on DSKBFK8HB2PROD with BILLS
HR 328 RFS
(C) submitted security vulnerabilities; and 
(D) received compensation; 
(2) the number and severity, in accordance with 
the National Vulnerabilities Database of the Na-
tional Institute of Standards and Technology, of se-
curity vulnerabilities reported as part of such pilot 
program; 
(3) the number of previously unidentified secu-
rity vulnerabilities remediated as a result of such 
pilot program; 
(4) the current number of outstanding pre-
viously unidentified security vulnerabilities and De-
partment remediation plans; 
(5) the average length of time between the re-
porting of security vulnerabilities and remediation of 
such vulnerabilities; 
(6) the types of compensation provided under 
such pilot program; and 
(7) the lessons learned from such pilot pro-
gram. 
Passed the House of Representatives January 22, 
2019. 
Attest: 
KAREN L. HAAS, 
Clerk. 
VerDate Sep 11 2014 
20:37 Jan 23, 2019
Jkt 089200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H328.RFS
H328
pamtmann on DSKBFK8HB2PROD with BILLS