Senators Introduce Bill to Let Hackers Reports Bugs to DHS
Sen. Rob Portman, R-Ohio Andrew Harnik/AP
Think of it as a standing bug bounty program.
A bipartisan pair of senators introduced a bill that would require the Homeland Security Department to create an ongoing program to allow security experts to report bugs on agency websites.
The Public-Private Cybersecurity Cooperation Act, introduced Thursday by Sen. Rob Portman, R-Ohio, and Maggie Hassan, D-N.H., requires Homeland Security to create a vulnerability disclosure program so hackers can report problems they find to the proper authorities without being prosecuted for breaking laws like the 1986 Computer Fraud and Abuse Act.
“This bill encourages ethical hackers to come forward with information they find about vulnerabilities in our government networks by assuring them that if they do, they’ll have protection under the law,” Hassan said in a statement.
If enacted, Homeland Security would have to develop a remediation process to address any reported bugs and present annual reports tracking how many are reported, how many are fixed and how long it’s taking between a flaw being reported and being fixed. Congress also wants to know how many people or organizations participate.
The bill is a companion piece to House version sponsored by Majority Leader Kevin McCarthy, R-Calif, which passed in late September.
The Senate already passed another cybersecurity bill from Portman and Hassan called the Hack the Department of Homeland Security Act. That bill would also encourage outside security researchers to report vulnerabilities to the agency, but in scheduled bug bounty competitions.
The Hack DHS Act is still waiting on House action.