,,id ,union ,calendar ,no4 #geb #aaeth ,,congress #b;d ,session ,s4 #abha ,report ,no4 #aae-ifd ,,in ,,the ,,house ,,of ,,representatives ,april #ah1 #bjah ,referred to the ,committee on ,homeland ,security ,september #be1 #bjah ,reported with an amendment1 committed to the ,committee of the ,whole ,house on the ,state of the ,union1 and ordered to be printed ,strike out all after the enacting clause and insert the part printed in italic ,for text of introduced bill1 see copy of bill as introduced on ,april #ah1 #bjah ,an ,act ,to establish a bug bounty pilot program within the ,department of ,homeland ,security1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,hack the ,department of ,homeland ,security ,act of #bjah or the ,hack ,,dhs ,act4 #b4 ,department of ,homeland ,security bug bounty pilot program 7a7 ,definitions ,in this section3 7#a7 ,bug bounty program ,the term bug bounty program means a program under which-- 7,a7 individuals1 organizations1 and companies are temporarily authorized to identify and report vulnerabilities of appropriate information systems of the ,department2 and 7,b7 eligible individuals1 organizations1 and companies receive compensation in exchange for such reports4 7#b7 ,department ,the term ,department means the ,department of ,homeland ,security4 7#c7 ,eligible individual1 organization1 or company ,the term eligible individual1 organization1 or company means an individual1 organization1 or company that meets such criteria as the ,secretary determines in order to receive compensation in compliance with ,federal laws4 7#d7 ,information system ,the term information system has the meaning given that term by section #cejb of title #dd1 ,united ,states ,code4 7#e7 ,pilot program ,the term pilot program means the bug bounty pilot program required to be established under subsection 7b77#a74 7#f7 ,secretary ,the term ,secretary means the ,secretary of ,homeland ,security4 7b7 ,establishment of pilot program 7#a7 ,in general ,not later than #ahj days after the date of enactment of this ,act1 the ,secretary shall establish1 within the ,office of the ,chief ,information ,officer1 a bug bounty pilot program to minimize vulnerabilities of appropriate information systems of the ,department4 7#b7 ,requirements ,in establishing and conducting the pilot program1 the ,secretary shall-- 7,a7 designate appropriate information systems to be included in the pilot program2 7,b7 provide compensation to eligible individuals1 organizations1 and companies for reports of previously unidentified security vulnerabilities within the information systems designated under subparagraph 7,a72 7,c7 establish criteria for individuals1 organizations1 and companies to be considered eligible for compensation under the pilot program in compliance with ,federal laws2 7,d7 consult with the ,attorney ,general on how to ensure that approved individuals1 organizations1 or companies that comply with the requirements of the pilot program are protected from prosecution under section #ajcj of title #ah1 ,united ,states ,code1 and similar provisions of law1 and civil lawsuits for specific activities authorized under the pilot program2 7,e7 consult with the ,secretary of ,defense and the heads of other departments and agencies that have implemented programs to provide compensation for reports of previously undisclosed vulnerabilities in information systems1 regarding lessons that may be applied from such programs2 and 7,f7 develop an expeditious process by which an individual1 organization1 or company can register with the ,department1 submit to a background check as determined by the ,department1 and receive a determination as to eligibility2 and 7,g7 engage qualified interested persons1 including non-government sector representatives1 about the structure of the pilot program as constructive and to the extent practicable4 7#c7 ,contract ,in establishing the pilot program1 the ,secretary1 subject to the availability of appropriations1 may award one or more competitive contracts to an entity1 as necessary1 to manage the pilot program4 7c7 ,report ,not later than #ahj days after the date on which the pilot program is completed1 the ,secretary of ,homeland ,security shall submit to the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate and the ,committee on ,homeland ,security of the ,house of ,representatives a report on the pilot program1 which shall include-- 7#a7 the number of individuals1 organizations1 or companies that participated in the pilot program1 broken down by the number of individuals1 organizations1 or companies that-- 7,a7 registered2 7,b7 were determined eligible2 7,c7 submitted security vulnerabilities2 and 7,d7 received compensation2 7#b7 the number and severity of vulnerabilities reported as part of the pilot program2 7#c7 the number of previously unidentified security vulnerabilities remediated as a result of the pilot program2 7#d7 the current number of outstanding previously unidentified security vulnerabilities and ,department remediation plans2 7#e7 the average length of time between the reporting of security vulnerabilities and remediation of the vulnerabilities2 7#f7 the types of compensation provided under the pilot program2 and 7#g7 the lessons learned from the pilot program4 7d7 ,authorization of appropriations ,there are authorized to be appropriated to the ,department #bej1jjj for fiscal year #bjai to carry out this ,act4 ,september #be1 #bjah ,reported with an amendment1 committed to the ,committee of the ,whole ,house on the ,state of the ,union1 and ordered to be printed