1. Short title
This Act may be cited as the “Hack Your State Department Act”.
Hack Your State Department Act
A BILL
To require the Secretary of State to design and establish a Vulnerability Disclosure Process to improve Department of State cybersecurity and a bug bounty program to identify and report vulnerabilities of Internet-facing information technology of the Department of State, and for other purposes.
2. Definitions
In this Act:
Bug bounty program— The term bug bounty program means a program under which an approved individual, organization, or company is temporarily authorized to identify and report vulnerabilities of Internet-facing information technology of the Department in exchange for compensation.
Department— The term Department means the Department of State.
Information technology— The term information technology has the meaning given such term in section 11101 of title 40, United States Code.
Secretary— The term Secretary means the Secretary of State.
VDP— The term VDP means the Vulnerability Disclosure Process established pursuant to section 3.
3. Department of State Vulnerability Disclosure Process
In general— Not later than 180 days after the date of the enactment of this Act, the Secretary shall design, establish, and make publicly known a Vulnerability Disclosure Process to improve cybersecurity within the Department by—
providing security researchers with clear guidelines for—
conducting vulnerability discovery activities directed at Department information technology; and
submitting discovered security vulnerabilities to the Department; and
creating Department procedures and infrastructure to receive and fix discovered vulnerabilities.
Requirements— In establishing VDP pursuant to subsection (a), the Secretary shall—
identify which Department information technology should be included in the process;
determine whether the process should differentiate among and specify the types of security vulnerabilities that may be targeted;
provide a readily available means of reporting discovered security vulnerabilities and the form in which such vulnerabilities should be reported;
identify which Department offices and positions will be responsible for receiving, prioritizing, and addressing security vulnerability disclosure reports;
consult with the Attorney General regarding how to ensure that individuals, organizations, and companies that comply with the VDP requirements are protected from prosecution under section 1030 of title 18, United States Code, and similar provisions of law for specific activities authorized under VDP;
consult with the relevant offices at the Department of Defense that were responsible for launching the 2016 Vulnerability Disclosure Program, “Hack the Pentagon”, and subsequent Department of Defense bug bounty programs;
engage qualified interested persons, including nongovernmental sector representatives, about the structure of VDP, as constructive and to the extent practicable; and
award contracts to entities, as necessary, to manage VDP and implement the remediation of discovered security vulnerabilities.
Annual reports— Not later than 180 days after the establishment of VDP under subsection (a) and annually thereafter for the following 6 years, the Secretary shall submit a report to the Committee on Foreign Relations of the Senate and the Committee on Foreign Affairs of the House of Representatives regarding the establishment of VDP, including information relating to—
the number and severity, in accordance with the National Vulnerabilities Database of the National Institute of Standards and Technology, of security vulnerabilities reported through VDP;
the number of previously unidentified security vulnerabilities remediated as a result of such reporting;
the current number of outstanding previously unidentified security vulnerabilities and the Department's remediation plans to address such vulnerabilities;
the average period between the reporting of security vulnerabilities and the remediation of such vulnerabilities;
the resources, surge staffing, roles, and responsibilities within the Department used to implement VDP and complete the necessary security vulnerability remediation; and
any other information that the Secretary determines to be relevant.
4. Department of State Bug Bounty Pilot Program
Establishment of pilot program—
In general— Not later than 1 year after the date of the enactment of this Act, the Secretary shall establish a Bug Bounty Pilot Program to minimize security vulnerabilities of Internet-facing information technology of the Department.
Requirements— In establishing the pilot program under paragraph (1), the Secretary shall—
provide compensation for reports of previously unidentified security vulnerabilities within the websites, applications, and other Internet-facing information technology of the Department that are accessible to the public;
award contracts to entities, as necessary, to manage the pilot program and for executing the remediation of security vulnerabilities identified pursuant to subparagraph (A);
identify which Department information technology should be included in the pilot program;
consult with the Attorney General on how to ensure that individuals, organizations, or companies that comply with the requirements of the pilot program are protected from prosecution under section 1030 of title 18, United States Code, and similar provisions of law for specific activities authorized under the pilot program;
consult with the relevant offices at the Department of Defense that were responsible for launching the 2016 “Hack the Pentagon” pilot program and subsequent Department of Defense bug bounty programs;
develop a process by which an approved individual, organization, or company can—
register with entities referred to in subparagraph (B);
submit to a background check, as determined by the Department; and
receive a determination as to eligibility for participation in the pilot program;
engage qualified interested persons, including nongovernmental sector representatives, about the structure of the pilot program, as constructive and to the extent practicable; and
consult with relevant United States Government officials to ensure that the pilot program complements persistent network and vulnerability scans of the Department’s Internet-accessible systems, such as the scans conducted pursuant to Binding Operational Directive 15–01, issued by the Secretary of Homeland Security on May 21, 2015.
Duration— The pilot program established under paragraph (1) should be terminated not later than 1 year after the date on which it is established.
Report— Not later than 180 days after the completion of the Bug Bounty Pilot Program under subsection (a), the Secretary shall submit a report to the Committee on Foreign Relations of the Senate and the Committee on Foreign Affairs of the House of Representatives that describes the pilot program, including information regarding—
the number of approved individuals, organizations, or companies involved in the pilot program, broken down by—
the number of approved individuals, organizations, or companies that registered for the pilot program;
the number of such entities that were approved to participate in the pilot program;
the number of such entities that submitted security vulnerabilities under the pilot program; and
the number of such entities that received compensation under the pilot program;
the number and severity, in accordance with the National Vulnerabilities Database of the National Institute of Standards and Technology, of security vulnerabilities reported under the pilot program;
the number of previously unidentified security vulnerabilities remediated as a result of the pilot program;
the current number of outstanding previously unidentified security vulnerabilities and the Department's plans for remediating such vulnerabilities;
the average period between the reporting of security vulnerabilities and the remediation of such vulnerabilities;
the types of compensation provided under the pilot program; and
the lessons learned from the pilot program.