I 
115TH CONGRESS 
2D SESSION 
H. R. 5433 
To require the Secretary of State to design and establish a Vulnerability 
Disclosure Program (VDP) to improve Department of State cybersecurity 
and a bug bounty program to identify and report vulnerabilities of 
internet-facing information technology of the Department of State, and 
for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
APRIL 5, 2018 
Mr. TED LIEU of California (for himself and Mr. YOHO) introduced the 
following bill; which was referred to the Committee on Foreign Affairs 
A BILL 
To require the Secretary of State to design and establish 
a Vulnerability Disclosure Program (VDP) to improve 
Department of State cybersecurity and a bug bounty 
program to identify and report vulnerabilities of internet- 
facing information technology of the Department of 
State, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Hack Your State De-
partment Act’’. 
VerDate Sep 11 2014 
01:06 Apr 06, 2018
Jkt 079200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H5433.IH
H5433
pamtmann on DSKBFK8HB2PROD with BILLS
SEC. 2. DEFINITIONS. 
In this Act: 
(1) DEPARTMENT.—The term ‘‘Department’’ 
means the Department of State. 
(2) INFORMATION
TECHNOLOGY.—The term 
‘‘information technology’’ has the meaning given 
such term in section 11101 of title 40, United 
States Code. 
(3) SECRETARY.—The term ‘‘Secretary’’ means 
the Secretary of State. 
SEC. 3. DEPARTMENT OF STATE VULNERABILITY DISCLO-
SURE PROGRAM. 
(a) IN GENERAL.—Not later than 180 days after the 
date of the enactment of this Act, the Secretary shall de-
sign, establish, and make publicly known a Vulnerability 
Disclosure Program (VDP) to improve Department cyber-
security by— 
(1) providing security researchers with clear 
guidelines for— 
(A) conducting vulnerability discovery ac-
tivities directed at Department information 
technology; and 
(B) 
submitting 
discovered 
security 
vulnerabilities to the Department; and 
VerDate Sep 11 2014 
01:08 Apr 06, 2018
Jkt 079200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H5433.IH
H5433
pamtmann on DSKBFK8HB2PROD with BILLS
(2) creating Department procedures and infra-
structure 
to 
receive 
and 
fix 
discovered 
vulnerabilities. 
(b) REQUIREMENTS.—In establishing the VDP pur-
suant to paragraph (1), the Secretary shall— 
(1) identify which Department information 
technology should be included in the program; 
(2) determine whether the program should dif-
ferentiate among and specify the types of security 
vulnerabilities that may be targeted; 
(3) provide a readily available means of report-
ing discovered security vulnerabilities and the form 
in which such vulnerabilities should be reported; 
(4) identify which Department offices and posi-
tions will be responsible for receiving, prioritizing, 
and addressing security vulnerability disclosure re-
ports; 
(5) consult with the Attorney General regarding 
how to ensure that approved individuals, organiza-
tions, and companies that comply with the require-
ments of the program are protected from prosecu-
tion under section 1030 of title 18, United States 
Code, and similar provisions of law for specific ac-
tivities authorized under the program; 
VerDate Sep 11 2014 
01:06 Apr 06, 2018
Jkt 079200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H5433.IH
H5433
pamtmann on DSKBFK8HB2PROD with BILLS
(6) consult with the relevant offices at the De-
partment of Defense that were responsible for 
launching the 2016 Vulnerability Disclosure Pro-
gram, ‘‘Hack the Pentagon’’, and subsequent De-
partment of Defense bug bounty programs; 
(7) engage qualified interested persons, includ-
ing nongovernmental sector representatives, about 
the structure of the program as constructive and to 
the extent practicable; and 
(8) award a contract to an entity, as necessary, 
to manage the program and implement the remedi-
ation of discovered security vulnerabilities. 
(c) ANNUAL REPORTS.—Not later than 180 days 
after the establishment of the VDP under subsection (a) 
and annually thereafter for the next six years, the Sec-
retary of State shall submit to the Committee on Foreign 
Affairs of the House of Representatives and the Com-
mittee on Foreign Relations of the Senate a report on the 
following with respect to the VDP: 
(1) The number and severity, in accordance 
with the National Vulnerabilities Database of the 
National Institute of Standards and Technology, of 
security vulnerabilities reported. 
(2) The number of previously unidentified secu-
rity vulnerabilities remediated as a result. 
VerDate Sep 11 2014 
01:06 Apr 06, 2018
Jkt 079200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H5433.IH
H5433
pamtmann on DSKBFK8HB2PROD with BILLS
(3) The current number of outstanding pre-
viously unidentified security vulnerabilities and De-
partment of State remediation plans. 
(4) The average length of time between the re-
porting of security vulnerabilities and remediation of 
such vulnerabilities. 
(5) An estimate of the total cost savings of dis-
covering and addressing security vulnerabilities sub-
mitted through the VDP. 
(6) The resources, surge staffing, roles, and re-
sponsibilities within the Department used to imple-
ment the VDP and complete security vulnerability 
remediation. 
(7) Any other information the Secretary deter-
mines relevant. 
SEC. 4. DEPARTMENT OF STATE BUG BOUNTY PILOT PRO-
GRAM. 
(a) ESTABLISHMENT OF PILOT PROGRAM.— 
(1) IN
GENERAL.—Not later than one year 
after the date of the enactment of this Act, the Sec-
retary shall establish a bug bounty pilot program to 
minimize security vulnerabilities of internet-facing 
information technology of the Department. 
VerDate Sep 11 2014 
01:06 Apr 06, 2018
Jkt 079200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H5433.IH
H5433
pamtmann on DSKBFK8HB2PROD with BILLS
(2) REQUIREMENTS.—In establishing the pilot 
program described in paragraph (1), the Secretary 
shall— 
(A) provide compensation for reports of 
previously unidentified security vulnerabilities 
within the websites, applications, and other 
internet-facing information technology of the 
Department that are accessible to the public; 
(B) award a contract to an entity, as nec-
essary, to manage such pilot program and for 
executing 
the 
remediation 
of 
security 
vulnerabilities identified pursuant to subpara-
graph (A); 
(C) identify which Department information 
technology should be included in such pilot pro-
gram; 
(D) consult with the Attorney General on 
how to ensure that approved individuals, orga-
nizations, or companies that comply with the 
requirements of such pilot program are pro-
tected from prosecution under section 1030 of 
title 18, United States Code, and similar provi-
sions of law for specific activities authorized 
under such pilot program; 
VerDate Sep 11 2014 
01:06 Apr 06, 2018
Jkt 079200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H5433.IH
H5433
pamtmann on DSKBFK8HB2PROD with BILLS
(E) consult with the relevant offices at the 
Department of Defense that were responsible 
for launching the 2016 ‘‘Hack the Pentagon’’ 
pilot program and subsequent Department of 
Defense bug bounty programs; 
(F) develop a process by which an ap-
proved individual, organization, or company can 
register with the entity referred to in subpara-
graph (B), submit to a background check as de-
termined by the Department, and receive a de-
termination as to eligibility for participation in 
such pilot program; and 
(G) engage qualified interested persons, in-
cluding nongovernmental sector representatives, 
about the structure of such pilot program as 
constructive and to the extent practicable. 
(b) REPORT.—Not later than 90 days after the date 
on which the bug bounty pilot program under subsection 
(a) is completed, the Secretary shall submit to the Com-
mittee on Foreign Relations of the Senate and the Com-
mittee on Foreign Affairs of the House of Representatives 
a report on such pilot program, including information re-
lating to— 
(1) the number of approved individuals, organi-
zations, or companies involved in such pilot pro-
VerDate Sep 11 2014 
01:06 Apr 06, 2018
Jkt 079200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H5433.IH
H5433
pamtmann on DSKBFK8HB2PROD with BILLS
gram, broken down by the number of approved indi-
viduals, organizations, or companies that— 
(A) registered; 
(B) were approved; 
(C) submitted security vulnerabilities; and 
(D) received compensation; 
(2) the number and severity, in accordance with 
the National Vulnerabilities Database of the Na-
tional Institute of Standards and Technology, of se-
curity vulnerabilities reported as part of such pilot 
program; 
(3) the number of previously unidentified secu-
rity vulnerabilities remediated as a result of such 
pilot program; 
(4) the current number of outstanding pre-
viously unidentified security vulnerabilities and De-
partment remediation plans; 
(5) the average length of time between the re-
porting of security vulnerabilities and remediation of 
such vulnerabilities; 
(6) the types of compensation provided under 
such pilot program; and 
(7) the lessons learned from such pilot pro-
gram. 
Æ 
VerDate Sep 11 2014 
01:06 Apr 06, 2018
Jkt 079200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6301
E:\BILLS\H5433.IH
H5433
pamtmann on DSKBFK8HB2PROD with BILLS