On Thursday, the US Department of Defense announced the launch of a pilot bug-bounty program for the DOD's public-facing websites. Called "Hack the Pentagon," the bounty program will be managed by HackerOne, the disclosure-as-a-service company founded by Alex Rice and Michiel Prins.
Since Hack the Pentagon is a pilot, its budget and duration are fairly modest by DOD standards. The Pentagon has budgeted $150,000 for the monthlong bug hunt, which will begin on Monday, April 18 and end by Thursday, May 12. Payouts for accepted bugs will come from HackerOne and will be doled out by June 10.
Pentagon Press Secretary Peter Cook did not specify which DOD sites would be considered fair game for Hack the Pentagon. "The program will target several DoD public websites which will be identified to the participants as the beginning of the challenge approaches," he said. "Critical, mission-facing computer systems will not be involved in the program."
The program is not open to everyone. HackerOne's page for the program states that only people who meet the following conditions will be eligible for participation:
- You must have successfully registered as a participant through this security page.
- You must have a US taxpayer identification number and a Social Security number or an employee identification number and the ability to complete required verification forms.
- You must be eligible to work within the US; meaning you are a US citizen, a noncitizen national of the US, a lawful permanent resident, or an alien authorized to work within the US
- You must not reside in a country currently under US trade sanctions.
- You must not be on the US Department of the Treasury's Specially Designated Nationals list [a list of people and organizations identified as being involved with terrorism, drug trafficking, and other criminal activities].
But that's not all. "In addition," Cook said, "successful participants who submit qualifying vulnerability reports will undergo a basic criminal background screening to ensure taxpayer dollars are spent wisely." If you'd rather not go through that screening, you can still submit bugs, but you'll have to decline any payments.
The cash value of bounties also wasn't revealed. "Individual bounties will depend on a number of factors," Cook said.