DHS is Lukewarm on the Bug Bounty Programs Congress Keeps Pushing

Congress is itching to launch a bug bounty program at the Homeland Security Department, but department officials are ambivalent about the idea.

The Senate, on Tuesday, passed the Hack DHS Act, which mandates a bug bounty contest in which ethical hackers earn cash rewards for spotting digital vulnerabilities in Homeland Security websites and web tools.

One sponsor, Sen. Maggie Hassan, D-N.H., called the bill “vital” to protecting Homeland Security’s networks from malicious hackers and praised bug bounties for “harnessing the talent and skills of patriotic and ethical hackers across the country.”

A version of the legislation was also incorporated into a Homeland Security Reauthorization bill that passed the department’s Senate oversight committee in March.

According to a Homeland Security official, however, the bug bounty program would duplicate work the department’s own bug hunters are already doing.

If Congress doesn’t put sufficient funding behind the contest, it could also steal resources from more important cyber protection programs, said Chris Krebs, acting undersecretary for Homeland Security’s cyber and infrastructure protection division.

The Hack DHS bill includes $250,000 for the program. While the cost of running a Homeland Security bug bounty aren’t clear, the most recent military bug bounty, at the U.S. Air Force, paid out $104,000 in bounties, which doesn’t include other costs such as vetting participants and analyzing the validity of bug reports.

“We have the hunt and incident response team, which gets us the same capability,” Krebs said, referring to the Homeland Security division that scans government systems for vulnerabilities and responds to data breaches and other cyber incidents.

“If we wanted to add bandwidth and depth by bringing in pre-vetted and pre-cleared folks like [the Pentagon] did … we’re open to that program,” Krebs said. “But it has to be resourced appropriately. I don’t have a budget sitting anywhere that would be able to reward folks that found bugs.”

Krebs spoke with Nextgov about the possibility of a department bug bounty on Monday, before the Senate bill passed. Both Krebs and Homeland Security Secretary Kirstjen Nielsen noted that bug bounties can be an effective method for turning up cyber vulnerabilities, but that other methods are just as good.

“Bug bounties have a useful place,” Nielsen said. “Like anything, it’s not a silver bullet and, unfortunately, some in the conversation seemed to be under the impression that it was.”

If the department did adopt a bug bounty, Nielsen said, it would be “one tool in the toolbox” and would have to be structured so that it enhanced the department’s core cyber mission.

The military and Defense Department have launched four bug bounties—one each at the Pentagon and at the Army plus two at the Air Force. A fifth is in the works targeting the military’s travel booking system.

Civilian government, on the other hand, has generally steered clear of the hacking contests except for a program at the General Services Administration’s tech transformation service.

Congress, however, has other plans.

In addition to the Senate’s bug bounty bills, Reps. Scott Taylor, R-Va., and Ted Lieu, D-Calif., sponsored a House version of the Hack DHS Act. Lieu also co-sponsored a bill to create a State Department bug bounty with Rep. Ted Yoho, R-Fla.

Some of the officials and contractors who worked on the Pentagon bug bounties have criticized the congressional bounty push, calling the bills “well-meaning but misdirected.”

The Pentagon and military embarked on bug bounties after extensive study and when they were sure the bounties would be useful, those bounty experts said. If that upfront work isn’t done, there could be a load of unintended consequences.

In the case of smaller and less cyber-savvy agencies, a bug bounty might be jumping the gun, because the agencies aren’t equipped to expediently patch all the vulnerabilities they already know about, those bounty experts said.

Even Homeland Security, which is the lead cyber protection agency for the civilian government and highly cyber-savvy, would have to devote substantial resources to poring through duplicate and bogus bug reports, which would steal time and resources from other priorities.

Because most government websites and web tools are built by contractors, there will also likely be legal and contractual barriers to getting bugs patched.

Finally, there’s a concern that criminals or adversary nations could use the cover of a bug bounty program to probe or attack government systems.

The Pentagon mitigated that concern by limiting bug bounty participants, vetting everyone who signed up and making sure the language describing what bounty participants could and could not do was hyper clear and legally sound, said Katie Moussouris, a former chief policy officer with HackerOne, the company that helped launch the Hack the Pentagon bug bounty in 2016.

That concern still gives Homeland Security heartburn, though, Krebs said.

“I certainly don’t want to be in a position where we’re endorsing nation-states or other criminals to come in and hack us,” he said. “I think anytime you’re inviting someone to come in and knock on your door, to the extent you can have an understanding of who it is that you’re bringing into the fold, that’s always a good thing.”