#aaeth ,,congress  #b;d ,session  ,s4   
#abha  ,,an ,,act  ,to establish a bug  
bounty pilot program within the         
,department of ,homeland ,security1 and 
for other purposes4  #a4 ,short title   
,this ,act may be cited as the ,hack the
 ,department of ,homeland ,security ,act
 of #bjag or the ,hack ,,dhs ,act4  #b4 
,department of ,homeland ,security bug  
bounty pilot program  7a7 ,definitions  
,in this section3  7#a7 ,bug bounty     
program ,the term bug bounty program    
means a program under which an approved 
individual1 organization1 or company is 
temporarily authorized to identify and  
report vulnerabilities of               
,internet-facing information technology 
of the ,department in exchange for      
compensation4  7#b7 ,department ,the    
term ,department means the ,department  
of ,homeland ,security4  7#c7           
,information technology ,the term       
information technology has the meaning  
given the term in section #aaaja of     
title #dj1 ,united ,states ,code4  7#d7 

,pilot program ,the term pilot program  
means the bug bounty pilot program      
required to be established under        
subsection 7b77#a74  7#e7 ,secretary    
,the term ,secretary means the          
,secretary of ,homeland ,security4  7b7 
,establishment of pilot program  7#a7   
,in general ,not later than #ahj days   
after the date of enactment of this     
,act1 the ,secretary shall establish1   
within the ,office of the ,chief        
,information ,officer1 a bug bounty     
pilot program to minimize               
vulnerabilities of ,internet-facing     
information technology of the           
,department4  7#b7 ,requirements ,in    
establishing the pilot program1 the     
,secretary shall-- 7,a7 provide         
compensation for reports of previously  
unidentified security vulnerabilities   
within the websites1 applications1 and  
other ,internet-facing information      
technology of the ,department that are  
accessible to the public2  7,b7 award a 
competitive contract to an entity1 as   

necessary1 to manage the pilot program  
and for executing the remediation of    
vulnerabilities identified as a         
consequence of the pilot program2  7,c7 
designate mission-critical operations   
within the ,department that should be   
excluded from the pilot program2  7,d7  
consult with the ,attorney ,general on  
how to ensure that approved individuals1
 organizations1 or companies that comply
 with the requirements of the pilot     
program are protected from prosecution  
under section #ajcj of title #ah1       
,united ,states ,code1 and similar      
provisions of law for specific          
activities authorized under the pilot   
program2  7,e7 consult with the relevant
 offices at the ,department of ,defense 
that were responsible for launching the 
#bjaf ,hack the ,pentagon pilot program 
and subsequent ,department of ,defense  
bug bounty programs2  7,f7 develop an   
expeditious process by which an approved
 individual1 organization1 or company   
can register with the entity described  

in subparagraph 7,b71 submit to a       
background check as determined by the   
,department1 and receive a determination
 as to eligibility for participation in 
the pilot program2 and  7,g7 engage     
qualified interested persons1 including 
non-government sector representatives1  
about the structure of the pilot program
 as constructive and to the extent      
practicable4  7c7 ,report ,not later    
than #ahj days after the date on which  
the pilot program is completed1 the     
,secretary of ,homeland ,security shall 
submit to the ,committee on ,homeland   
,security and ,governmental ,affairs of 
the ,senate and the ,committee on       
,homeland ,security of the ,house of    
,representatives a report on the pilot  
program1 which shall include--  7#a7 the
 number of approved individuals1        
organizations1 or companies involved in 
the pilot program1 broken down by the   
number of approved individuals1         
organizations1 or companies that--  7,a7
 registered2  7,b7 were approved2  7,c7 

submitted security vulnerabilities2 and 
7,d7 received compensation2  7#b7 the   
number and severity of vulnerabilities  
reported as part of the pilot program2  
7#c7 the number of previously           
unidentified security vulnerabilities   
remediated as a result of the pilot     
program2  7#d7 the current number of    
outstanding previously unidentified     
security vulnerabilities and ,department
 remediation plans2  7#e7 the average   
length of time between the reporting of 
security vulnerabilities and remediation
 of the vulnerabilities2  7#f7 the types
 of compensation provided under the     
pilot program2 and  7#g7 the lessons    
learned from the pilot program4  7d7    
,authorization of appropriations ,there 
are authorized to be appropriated to the
 ,department #bej1jjj for fiscal year   
#bjah to carry out this ,act4  ,passed  
the ,senate ,april #ag1 #bjah4,secretary