,i  #aaeth ,,congress  #ast ,session    
,h4 ,r4 #chfh  ,,in ,,the ,,house ,,of  
,,representatives  ,september #bh1      
#bjag,mr4 ,budd introduced the following
 bill2 which was referred to the        
,committee on ,financial ,services1 and 
in addition to the ,committee on ,ways  
and ,means1 for a period to be          
subsequently determined by the ,speaker1
 in each case for consideration of such 
provisions as fall within the           
jurisdiction of the committee concerned 
,a ,,bill  ,to establish a bug bounty   
pilot program within the ,department of 
the ,treasury1 and for other purposes4  
#a4 ,short title ,this ,act may be cited
 as the ,treasury ,innovation ,act4  #b4
 ,department of the ,treasury bug bounty
 pilot program  7a7 ,definitions ,in    
this section3  7#a7 ,bug bounty pilot   
program ,the term bug bounty pilot      
program means a program under which an  
approved computer security specialist or
 security researcher is temporarily     
authorized to identify and report       

vulnerabilities within the information  
system of the ,department in exchange   
for cash payment4  7#b7 ,department ,the
 term ,department means the ,department 
of the ,treasury4  7#c7 ,information    
system ,the term information system has 
the meaning given the term in section   
#cejb of title #dd1 ,united ,states     
,code4  7#d7 ,pilot program ,the term   
pilot program means the bug bounty pilot
 program required to be established     
under subsection 7b77#a74  7#e7         
,secretary ,the term ,secretary means   
the ,secretary of the ,treasury4  7b7   
,establishment of pilot program  7#a7   
,in general ,not later than #ahj days   
after the date of the enactment of this 
,act1 the ,secretary shall establish a  
bug bounty pilot program to minimize    
vulnerabilities to the information      
systems of the ,department4  7#b7       
,requirements ,in establishing the pilot
 program1 the ,secretary shall-- 7,a7   
provide monetary compensations for      
reports of previously unidentified      

security vulnerabilities within the     
websites1 applications1 and other       
information systems of the ,department  
that are accessible to the public2  7,b7
 develop an expeditious process by which
 computer security researchers can      
register for the pilot program1 submit  
to a background check as determined by  
the ,department1 and receive a          
determination as to approval for        
participation in the pilot program2     
7,c7 designate mission-critical         
operations within the ,department that  
should be excluded from the pilot       
program2  7,d7 consult with the         
,attorney ,general on how to ensure that
 computer security specialists and      
security researchers who participate in 
the pilot program are protected from    
prosecution under section #ajcj of title
 #ah1 ,united ,states ,code1 and similar
 laws for specific activities authorized
 under the pilot program2  7,e7 consult 
with the relevant offices at the        
,department of ,defense that were       

responsible for launching the #bjaf     
,hack the ,pentagon pilot program and   
subsequent similar programs at the      
,department of ,defense2  7,f7 award    
competitive contracts as necessary to   
manage the pilot program and for        
executing the remediation of            
vulnerabilities identified as a         
consequence of the pilot program2 and   
7,g7 engage interested persons1 to      
include commercial sector               
representatives1 about the structure of 
the pilot program as constructive and to
 the extent practicable4  7c7 ,report   
,not later than #ij days after the date 
on which the pilot program is completed1
 the ,secretary shall submit to the     
,committee on ,financial ,services of   
the ,house of ,representatives and the  
,committee on ,banking1 ,housing1 and   
,urban ,affairs of the ,senate a report 
on the pilot program1 which shall       
include--  7#a7 the number of computer  
security researchers who registered1    
were approved1 submitted security       

vulnerabilities1 and received monetary  
compensation2  7#b7 the number and      
severity of previously unidentified     
vulnerabilities reported as part of the 
pilot program2  7#c7 the number of      
previously unidentified security        
vulnerabilities remediated as a result  
of the pilot program2  7#d7 the average 
length of time between the reporting of 
security vulnerabilities and remediation
 of the vulnerabilities2  7#e7 the      
average amount of money paid per unique 
vulnerability submitted and the total   
amount of money paid to security        
researchers under the pilot program2 and
  7#f7 the lessons learned from the     
pilot program4  7d7 ,authorization of   
appropriations ,there is authorized to  
be appropriated to the ,secretary of the
 ,treasury #ajj1jjj for fiscal year     
#bjai to carry out this ,act4