,,ii  #aaeth ,,congress  #ast ,session  
,s4 #abha  ,,in ,,the ,,senate ,,of     
,,the ,,united ,,states  ,may #be1 #bjag
 ,ms4 ,hassan 7for herself1 ,mr4        
,portman1 ,mrs4 ,mc,caskill1 and ,ms4   
,harris7 introduced the following bill2 
which was read twice and referred to the
 ,committee on ,homeland ,security and  
,governmental ,affairs  ,a ,,bill  ,to  
establish a bug bounty pilot program    
within the ,department of ,homeland     
,security1 and for other purposes4  #a4 
,short title  ,this ,act may be cited as
 the ,hack the ,department of ,homeland 
,security ,act of #bjag or the ,hack    
,,dhs ,act4  #b4 ,department of         
,homeland ,security ,bug ,bounty ,pilot 
,program  7a7 ,definitions ,in this     
section3 7#a7 ,bug bounty program ,the  
term bug bounty program means a program 
under which an approved computer        
security specialist or security         
researcher is temporarily authorized to 
identify and report vulnerabilities     
within the information system of the    

,department in exchange for cash        
payment4  7#b7 ,department ,the term    
,department means the ,department of    
,homeland ,security4  7#c7 ,information 
system ,the term information system has 
the meaning given the term in section   
#cejb of title #dd1 ,united ,states     
,code4  7#d7 ,pilot program ,the term   
pilot program means the bug bounty pilot
 program required to be established     
under subsection 7b77#a74  7#e7         
,secretary ,the term ,secretary means   
the ,secretary of ,homeland ,security4  
7b7 ,establishment of pilot program     
7#a7 ,in general ,not later than #ahj   
days after the date of enactment of this
 ,act1 the ,secretary shall establish a 
bug bounty pilot program to minimize    
vulnerabilities to the information      
systems of the ,department4  7#b7       
,requirements ,in establishing the pilot
 program1 the ,secretary shall-- 7,a7   
provide monetary compensation for       
reports of previously unidentified      
security vulnerabilities within the     

websites1 applications1 and other       
information systems of the ,department  
that are accessible to the public2  7,b7
 develop an expeditious process by which
 computer security researchers can      
register with the ,department1 submit to
 a background check as determined by the
 ,department1 and receive a             
determination as to approval for        
participation in the pilot program2     
7,c7 designate mission-critical         
operations within the ,department that  
should be excluded from the pilot       
program2  7,d7 consult with the         
,attorney ,general on how to ensure that
 computer security specialists and      
security researchers who participate in 
the pilot program are protected from    
prosecution under section #ajcj of title
 #ah1 ,united ,states ,code1 and similar
 provisions of law for specific         
activities authorized under the pilot   
program2  7,e7 consult with the relevant
 offices at the ,department of ,defense 
that were responsible for launching the 

#bjaf ,hack the ,pentagon pilot program 
and subsequent ,department of ,defense  
bug bounty programs2  7,f7 award        
competitive contracts as necessary to   
manage the pilot program and for        
executing the remediation of            
vulnerabilities identified as a         
consequence of the pilot program2 and   
7,g7 engage interested persons1         
including commercial sector             
representatives1 about the structure of 
the pilot program as constructive and to
 the extent practicable4  7c7 ,report   
,not later than #ij days after the date 
on which the pilot program is completed1
 the ,secretary of ,homeland ,security  
shall submit to the ,committee on       
,homeland ,security and ,governmental   
,affairs of the ,senate and the         
,committee on ,homeland ,security of the
 ,house of ,representatives a report on 
the pilot program1 which shall include--
  7#a7 the number of computer security  
researchers involved in the pilot       
program1 broken down by the number of   

computer security researchers who--     
7,a7 registered2  7,b7 were approved2   
7,c7 submitted security vulnerabilities2
 and  7,d7 received monetary            
compensation2  7#b7 the number and      
severity of previously unidentified     
vulnerabilities reported as part of the 
pilot program2  7#c7 the number of      
previously unidentified security        
vulnerabilities remediated as a result  
of the pilot program2  7#d7 the average 
length of time between the reporting of 
security vulnerabilities and remediation
 of the vulnerabilities2  7#e7 the      
average amount of monetary compensation 
paid per unique vulnerability submitted 
under the pilot program and the total   
amount of monetary compensation paid to 
computer security researchers under the 
pilot program2 and  7#f7 the lessons    
learned from the pilot program4  7d7    
,authorization of appropriations ,there 
are authorized to be appropriated to the
 ,department #bej1jjj for fiscal year   
#bjah to carry out this ,act4