,,ii ,cal5d> ,no4 #cce #aae? ,,congress 
#b;d ,session  ,s4 #abha ,report ,no4   
#aae-bji ,,9 ,,! ,,s5ate ,,( ,,! ,,unit$
 ,,/ates  ,may #be1 #bjag,ms4 ,hassan 7=
 h]self1 ,mr4 ,portman1 ,mrs4           
,mc,caskill1 ,ms4 ,h>ris1 & ,mr4 ,g>dn]7
 introduc$ ! foll[+ bill2 :i* 0 read    
twice & ref]r$ to ! ,committee on       
,homel& ,security & ,gov]nm5tal ,affairs
  ,febru>y #bf1 #bjah,report$ by ,mr4   
,johnson1 ) an amendment,strike out all 
aft] ! enact+ clause & ins]t ! "p pr9t$ 
9 italic  ,a ,,bill  ,to e/abli% a bug  
b\nty pilot program )9 ! ,dep>tm5t (    
,homel& ,security1 & = o!r purposes4    
#a4 ,%ort title ,?is ,act may be cit$ z 
! ,hack ! ,dep>tm5t ( ,homel& ,security 
,act ( #bjag or ! ,hack ,,dhs ,act4  #b4
 ,dep>tm5t ( ,homel& ,security ,bug     
,b\nty ,pilot ,program  7a7 ,def9itions 
,9 ?is section3 7#a7 ,bug b\nty program 
,! t]m bug b\nty program means a program
 "u :i* an approv$ comput] security     
speciali/ or security rese>*] is        
tempor>ily au?oriz$ to id5tify & report 

vuln]abilities )9 ! in=mation sy/em ( ! 
,dep>tm5t 9 ex*ange = ca% paym5t4  7#b7 
,dep>tm5t ,! t]m ,dep>tm5t means !      
,dep>tm5t ( ,homel& ,security4  7#c7    
,in=mation sy/em ,! t]m in=mation sy/em 
has ! mean+ giv5 ! t]m 9 section #cejb (
 title #dd1 ,unit$ ,/ates ,code4  7#d7  
,pilot program ,! t]m pilot program     
means ! bug b\nty pilot program requir$ 
to be e/abli%$ "u subsection 7b77#a74   
7#e7 ,secret>y ,! t]m ,secret>y means ! 
,secret>y ( ,homel& ,security4  7b7     
,e/abli%m5t ( pilot program  7#a7 ,9    
g5]al ,n lat] ?an #ahj days aft] ! date 
( enactm5t ( ?is ,act1 ! ,secret>y %all 
e/abli% a bug b\nty pilot program to    
m9imize vuln]abilities to ! in=mation   
sy/ems ( ! ,dep>tm5t4  7#b7 ,requirem5ts
 ,9 e/abli%+ ! pilot program1 !         
,secret>y %all-- 7,a7 provide monet>y   
comp5sation = reports ( previ\sly       
unid5tifi$ security vuln]abilities )9 ! 
websites1 applications1 & o!r in=mation 
sy/ems ( ! ,dep>tm5t t are accessible to
 ! public2  7,b7 develop an exp$iti\s   

process by :i* comput] security rese>*]s
 c regi/] ) ! ,dep>tm5t1 submit to a    
backgr\nd *eck z det]m9$ by ! ,dep>tm5t1
 & receive a det]m9ation z to approval =
 p>ticipation 9 ! pilot program2  7,c7  
designate mission-critical op]ations )9 
! ,dep>tm5t t %\ld be exclud$ f ! pilot 
program2  7,d7 consult ) ! ,attorney    
,g5]al on h[ to ensure t comput]        
security speciali/s & security rese>*]s 
:o p>ticipate 9 ! pilot program are     
protect$ f prosecution "u section #ajcj 
( title #ah1 ,unit$ ,/ates ,code1 &     
simil> provisions ( law = specific      
activities au?oriz$ "u ! pilot program2 
7,e7 consult ) ! relevant (fices at !   
,dep>tm5t ( ,def5se t 7 responsible =   
laun*+ ! #bjaf ,hack ! ,p5tagon pilot   
program & subsequ5t ,dep>tm5t ( ,def5se 
bug b\nty programs2  7,f7 aw>d          
competitive contracts z necess>y to     
manage ! pilot program & = execut+ !    
rem$iation ( vuln]abilities id5tifi$ z a
 consequ5ce ( ! pilot program2 &  7,g7  
engage int]e/$ p]sons1 includ+ comm]cial

 sector repres5tatives1 ab\t ! /ructure 
( ! pilot program z con/ructive & to !  
ext5t practicable4  7c7 ,report ,n lat] 
?an #ij days aft] ! date on :i* ! pilot 
program is complet$1 ! ,secret>y (      
,homel& ,security %all submit to !      
,committee on ,homel& ,security &       
,gov]nm5tal ,affairs ( ! ,s5ate & !     
,committee on ,homel& ,security ( !     
,h\se ( ,repres5tatives a report on !   
pilot program1 :i* %all include--  7#a7 
! numb] ( comput] security rese>*]s     
involv$ 9 ! pilot program1 brok5 d[n by 
! numb] ( comput] security rese>*]s :o--
  7,a7 regi/]$2  7,b7 7 approv$2  7,c7  
submitt$ security vuln]abilities2 &     
7,d7 receiv$ monet>y comp5sation2  7#b7 
! numb] & sev]ity ( previ\sly unid5tifi$
 vuln]abilities report$ z "p ( ! pilot  
program2  7#c7 ! numb] ( previ\sly      
unid5tifi$ security vuln]abilities      
rem$iat$ z a result ( ! pilot program2  
7#d7 ! av]age l5g? ( "t betwe5 ! report+
 ( security vuln]abilities & rem$iation 
( ! vuln]abilities2  7#e7 ! av]age am\nt

 ( monet>y comp5sation paid p] unique   
vuln]ability submitt$ "u ! pilot program
 & ! total am\nt ( monet>y comp5sation  
paid to comput] security rese>*]s "u !  
pilot program2 &  7#f7 ! lessons le>n$ f
 ! pilot program4  7d7 ,au?orization (  
appropriations ,!re are au?oriz$ to be  
appropriat$ to ! ,dep>tm5t #bej1jjj =   
fiscal ye> #bjah to c>ry out ?is ,act4  
#a4 ,%ort title ,?is ,act may be cit$ z 
! ,hack ! ,dep>tm5t ( ,homel& ,security 
,act ( #bjag or ! ,hack ,,dhs ,act4  #b4
 ,dep>tm5t ( ,homel& ,security bug b\nty
 pilot program  7a7 ,def9itions ,9 ?is  
section3  7#a7 ,bug b\nty program ,! t]m
 bug b\nty program means a program "u   
:i* an approv$ individual1 organization1
 or company is tempor>ily au?oriz$ to   
id5tify & report vuln]abilities (       
,int]net-fac+ in=mation te*nology ( !   
,dep>tm5t 9 ex*ange = comp5sation4  7#b7
 ,dep>tm5t ,! t]m ,dep>tm5t means !     
,dep>tm5t ( ,homel& ,security4  7#c7    
,in=mation te*nology ,! t]m in=mation   
te*nology has ! mean+ giv5 ! t]m 9      

section #aaaja ( title #dj1 ,unit$      
,/ates ,code4  7#d7 ,pilot program ,!   
t]m pilot program means ! bug b\nty     
pilot program requir$ to be e/abli%$ "u 
subsection 7b77#a74  7#e7 ,secret>y ,!  
t]m ,secret>y means ! ,secret>y (       
,homel& ,security4  7b7 ,e/abli%m5t (   
pilot program  7#a7 ,9 g5]al ,n lat] ?an
 #ahj days aft] ! date ( enactm5t ( ?is 
,act1 ! ,secret>y %all e/abli%1 )9 !    
,(fice ( ! ,*ief ,in=mation ,(fic]1 a   
bug b\nty pilot program to m9imize      
vuln]abilities ( ,int]net-fac+ in=mation
 te*nology ( ! ,dep>tm5t4  7#b7         
,requirem5ts ,9 e/abli%+ ! pilot        
program1 ! ,secret>y %all-- 7,a7 provide
 comp5sation = reports ( previ\sly      
unid5tifi$ security vuln]abilities )9 ! 
websites1 applications1 & o!r           
,int]net-fac+ in=mation te*nology ( !   
,dep>tm5t t are accessible to ! public2 
7,b7 aw>d a competitive contract to an  
entity1 z necess>y1 to manage ! pilot   
program & = execut+ ! rem$iation (      
vuln]abilities id5tifi$ z a consequ5ce (

 ! pilot program2  7,c7 designate       
mission-critical op]ations )9 !         
,dep>tm5t t %\ld be exclud$ f ! pilot   
program2  7,d7 consult ) ! ,attorney    
,g5]al on h[ to ensure t approv$        
individuals1 organizations1 or companies
 t comply ) ! requirem5ts ( ! pilot     
program are protect$ f prosecution "u   
section #ajcj ( title #ah1 ,unit$ ,/ates
 ,code1 & simil> provisions ( law =     
specific activities au?oriz$ "u ! pilot 
program2  7,e7 consult ) ! relevant     
(fices at ! ,dep>tm5t ( ,def5se t 7     
responsible = laun*+ ! #bjaf ,hack !    
,p5tagon pilot program & subsequ5t      
,dep>tm5t ( ,def5se bug b\nty programs2 
7,f7 develop an exp$iti\s process by :i*
 an approv$ individual1 organization1 or
 company c regi/] ) ! entity describ$ 9 
subp>agraph 7,b71 submit to a backgr\nd 
*eck z det]m9$ by ! ,dep>tm5t1 & receive
 a det]m9ation z to eligibility =       
p>ticipation 9 ! pilot program2 &  7,g7 
engage qualifi$ int]e/$ p]sons1 includ+ 
non-gov]nm5t sector repres5tatives1 ab\t

 ! /ructure ( ! pilot program z         
con/ructive & to ! ext5t practicable4   
7c7 ,report ,n lat] ?an #ij days aft] ! 
date on :i* ! pilot program is complet$1
 ! ,secret>y ( ,homel& ,security %all   
submit to ! ,committee on ,homel&       
,security & ,gov]nm5tal ,affairs ( !    
,s5ate & ! ,committee on ,homel&        
,security ( ! ,h\se ( ,repres5tatives a 
report on ! pilot program1 :i* %all     
include--  7#a7 ! numb] ( approv$       
individuals1 organizations1 or companies
 involv$ 9 ! pilot program1 brok5 d[n by
 ! numb] ( approv$ individuals1         
organizations1 or companies t--  7,a7   
regi/]$2  7,b7 7 approv$2  7,c7 submitt$
 security vuln]abilities2 &  7,d7       
receiv$ comp5sation2  7#b7 ! numb] &    
sev]ity ( vuln]abilities report$ z "p ( 
! pilot program2  7#c7 ! numb] (        
previ\sly unid5tifi$ security           
vuln]abilities rem$iat$ z a result ( !  
pilot program2  7#d7 ! curr5t numb] (   
out/&+ previ\sly unid5tifi$ security    
vuln]abilities & ,dep>tm5t rem$iation   

plans2  7#e7 ! av]age l5g? ( "t betwe5 !
 report+ ( security vuln]abilities &    
rem$iation ( ! vuln]abilities2  7#f7 !  
types ( comp5sation provid$ "u ! pilot  
program2 &  7#g7 ! lessons le>n$ f !    
pilot program4  7d7 ,au?orization (     
appropriations ,!re are au?oriz$ to be  
appropriat$ to ! ,dep>tm5t #bej1jjj =   
fiscal ye> #bjah to c>ry out ?is ,act4  
,febru>y #bf1 #bjah,report$ ) an am5dm5t