S. 1281 — what changed

changed Bug bounty program— The term bug bounty program means a program under which an approved computer security specialist individual, organization, or security researcher company is temporarily authorized to identify and report vulnerabilities within the of Internet-facing information system technology of the Department in exchange for cash payment.compensation.

changed Information system—technology— The term information system technology has the meaning given the term in section 3502 11101 of title 44, 40, United States Code.

changed In general— Not later than 180 days after the date of enactment of this Act, the Secretary shall establish establish, within the Office of the Chief Information Officer, a bug bounty pilot program to minimize vulnerabilities to the of Internet-facing information systems technology of the Department.

changed provide monetary compensation for reports of previously unidentified security vulnerabilities within the websites, applications, and other Internet-facing information systems technology of the Department that are accessible to the public;

changed develop an expeditious process by which computer security researchers can register with the Department, submit to award a background check competitive contract to an entity, as determined by necessary, to manage the Department, pilot program and receive a determination as to approval for participation in executing the remediation of vulnerabilities identified as a consequence of the pilot program;

changed consult with the Attorney General on how to ensure that computer security specialists and security researchers who participate in approved individuals, organizations, or companies that comply with the requirements of the pilot program are protected from prosecution under section 1030 of title 18, United States Code, and similar provisions of law for specific activities authorized under the pilot program;

changed award competitive contracts as necessary develop an expeditious process by which an approved individual, organization, or company can register with the entity described in subparagraph (B), submit to manage a background check as determined by the pilot program Department, and for executing the remediation of vulnerabilities identified as receive a consequence of determination as to eligibility for participation in the pilot program; and

changed engage qualified interested persons, including commercial non-government sector representatives, about the structure of the pilot program as constructive and to the extent practicable.

changed Report— Not later than 90 180 days after the date on which the pilot program is completed, the Secretary of Homeland Security shall submit to the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Homeland Security of the House of Representatives a report on the pilot program, which shall include—

changed the number of computer security researchers approved individuals, organizations, or companies involved in the pilot program, broken down by the number of computer security researchers who—approved individuals, organizations, or companies that—

changed received monetary compensation;

changed the number and severity of previously unidentified vulnerabilities reported as part of the pilot program;