Slashdot Mirror
US Senators Propose Bug Bounties For Hacking Homeland Security (cnn.com)
An anonymous reader quotes CNN:
U.S. senators want people to hack the Department of Homeland Security. On Thursday, Senators Maggie Hassan, a Democrat and Republican Rob Portman introduced the Hack DHS Act to establish a federal bug bounty program in the DHS... It would be modeled off the Department of Defense efforts, including Hack the Pentagon, the first program of its kind in the federal government. Launched a year ago, Hack the Pentagon paved the way for more recent bug bounty events including Hack the Army and Hack the Air Force...
The Hack the DHS Act establishes a framework for bug bounties, including establishing "mission-critical" systems that aren't allowed to be hacked, and making sure researchers who find bugs in DHS don't get prosecuted under the Computer Fraud and Abuse Act. "It's better to find vulnerabilities through someone you have engaged with and vetted," said Jeff Greene, the director of government affairs and policy at security firm Symantec. "In an era of constrained budgets, it's a cost-effective way of identifying vulnerabilities"... If passed, it would be among the first non-military bug bounty programs in the public sector.
The Hack the DHS Act establishes a framework for bug bounties, including establishing "mission-critical" systems that aren't allowed to be hacked, and making sure researchers who find bugs in DHS don't get prosecuted under the Computer Fraud and Abuse Act. "It's better to find vulnerabilities through someone you have engaged with and vetted," said Jeff Greene, the director of government affairs and policy at security firm Symantec. "In an era of constrained budgets, it's a cost-effective way of identifying vulnerabilities"... If passed, it would be among the first non-military bug bounty programs in the public sector.
Hmmm. Yes... Nope, not biting. No way. Not a chance.
If you want news from today, you have to come back tomorrow.
The Computer Fraud and Abuse Act of 1986 imposes very harsh penalties for hacking and has been used as a hammer to crush individuals who've managed to draw the attention of the authorities. The US Government has used this law repeatedly over the years to destroy the lives of promising young Americans with prodigious computer skills who were relatively harmless if somewhat misguided. For example, the case of Aaron Schwartz comes easily to mind. Fast forward thirty years and now that cyber security is a thing they want our help? Talk about ingratitude.
If you get any credible proof you've succeeded, you're still going to Gitmo for the rest of your life.
Sure, some mysterious government organization starts a hacking contest. Then, if you win, Samaritan has you killed.
Nice try!
#DeleteChrome
This program, if implemented (snowball's chance in hell), will be answered by no one of merit. The government has been making enemies of these people it now needs for decades. This really seems like a desperate attempt to detour around several of the government's long standing and self-defeating policies.
If you get any credible proof you've succeeded, you're still going to Gitmo for the rest of your life.
Of course not! When you succeed hacking the DHS:
- If you didn’t get caught, you sell your data to Russia as usual for a rather large reward.
- If you did get caught, you explain that this was for the bug hunt and submit your findings to the DHS for a much smaller reward.
How much are they going to pay for exploits?
Now how much more are those exploits worth on the market to the right enemy states?
Also, you're assuming the researchers have a dollar amount to begin with. With the mission of a Holy War driving you, helping your home team will outweigh a bunch of greenbacks.
Your Honour, I swear the only reason I went to that URL 290 times last week is because my buddy said the best way to get all up in the NSA's business is through one of their fake porn sites.
Honest.
I've calculated my velocity with such exquisite precision that I have no idea where I am.
But I have to fly in the next few days. And the TSA isn't noted for their sense of humor.
So I'm just going to refrain until I get back home.
Have gnu, will travel.
Not that I think companies implementing bug bounties is a bad idea, but for government departments, I wouldn't be too sure...
Problems aplenty. For hackers, it's hard to overcome years of being looked down upon, plus the risks of being prossecuted.
And then, for stuff on this level there are always chances of other governments doubling the offer.
CIA is plenty ok with keeping the bugs and exploits they find for themselves, why wouldn't others also do it? Not sure how much of a cross section there is between hardcore patriots and hackers.
In any case, given the situation, perhaps it's the only reasonable way to go. Hiring based on competence doesn't seem to be much of a thing for this administration.
"mission-critical" systems [that] aren't allowed to be hacked
OK, since the purpose is finding bugs, I guess "mission-critical" is a code word for "these can stay broken". ;)
Ezekiel 23:20
Now that NSA's tool-belt is spilled how do we get a new one? A contest!
Wouldn't it be great if our government would work with us to secure our assets rather than working against us for their own nefarious undisclosed reasons?
You assume that the government agencies work together. They do not - which is laughably, transparently obvious. This program started with good intentions - all the way back in 2004 - but so much has happened with different agencies with their own agendas that no one trusts anyone.
Years ago I saw some child porn, so as a good citizen I reported it, When nothing was done after a week, I informed the newspapers. The next day the child porn was gone. Me was happy.
Then came at my work (where I had done it all) the COO to me and asked me if he was allowed to give my details to the police, due to an investigation about child porn. So I explained him what has happened and I also showed the emails I had send. As I had done the right thing, I allowed to give my details.
I was then ordered by the police to go to them and they where after me for.
1) Obstruction of the law, because I informed the press about an ongoing investigation. "Oh, you send an email? Our mailserver is down at the moment, Sorry."
2) Spreading of childporn. "Oh, so you just did a reply on a message on Usenet where the URL was in saying that you would be reporting it? Ok, not that bad as it was already known, we guess."
3) Falsification of information "Yes, we understand that you gave fake information to a free email address."
So not only where they clueless, if I would have had a different COO, I could have been fired as they told that it was about child porn.
Since then I have not seen anything even remotely illegal on the Interwebs and I am sure that I never will.
Don't fight for your country, if your country does not fight for you.
Pre-1990: Pravda runs a contest for the best political joke. First prize: All-expenses paid trip to Sibiria.
Post-2001: Homeland security runs a contest for the best hack: First prize. All-expenses paid trip to Cuba.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
It's just a fucking trap. You do all the work to find the vulnerabilities and weaknesses, document them, submit them, get ignored, get ignored, get ignored, and then suddenly a bunch of FBI goons show up and arrest you for hacking and act like YOU are the criminal for trying to find and warn them about their own problems.
Oh sign me up! /s
Sig for hire.
Have gnu, will travel.