DOD to invite security experts to Hack the Pentagon

2297308
Members of the Louisiana National Guard Cyber Defense Incident Response Team train at Louisiana State University in Baton Rouge on Nov. 15, 2015.
Credit: Garrett Dipuma/DOD

The cyber bug bounty program is a first for the federal government, but you'll need to undergo a background check

The U.S. Department of Defense plans to ask computer security experts to Hack the Pentagon as part of a push to improve its cyber defenses.

The initiative is similar to the bug bounty programs run by commercial software companies seeking to reward hackers who report security vulnerabilities in code. The DOD says it's the first cyber bug bounty program in the history of the federal government.

The DOD program, which will launch in April, will ask participants to examine its public Web pages, searching out vulnerabilities and attack launching points.

But the program will only go that far. The DOD's classified networks will be off-limits to the participants, and they won't be free to launch actual attacks on any of the department's public-facing sites.

The Pentagon will recruit participants through crowdsourcing websites, and they'll be required to register and submit to a background check. Once approved, they'll have access to a system chosen by the DOD for a predetermined amount of time.

Participants could be eligible for "monetary awards and other recognition," the DOD said.

Jonathan Cran, vice president of operations at Bugcrowd, which runs bug bounty programs for businesses, said they are a cost-effective way of finding cyber problems.

"For the same amount of money spent on bug bounty where you pay for results rather than paying for effort and time, versus hiring consultants, there’s no better way to do it," he said.

Secretary of Defense Ash Carter has spoken a lot about the need for his department to work more closely with Silicon Valley and emulate some of the ways in which tech start-ups operate and innovate.

The Hack the Pentagon program is a product of just such an initiative: the Defense Digital Service, a small team of engineers, affiliated with the U.S. Digital Service, that seeks to improve the DOD's technological agility. Carter launched the Defense Digital Service last November.

“I am always challenging our people to think outside the five-sided box that is the Pentagon,” he said in a statement. “Inviting responsible hackers to test our cybersecurity certainly meets that test."

The Pentagon said it would offer more details about the program and how to apply in the coming weeks.

Download the State of the CIO 2016 report
View Comments
Join the discussion
Be the first to comment on this article. Our Commenting Policies