DOD Launching Expanded Hack the Pentagon Bug Bounty Program
The Hack the Pentagon bug bounty program—which Defense Secretary Ashton Carter announced last March at the RSA security conference—lasted several weeks, but it was so successful that the Department of Defense is now following up with an expanded initiative.
The new, expanded DOD bug bounty effort will be operated by HackerOne and Synack. In a bug bounty program, security researchers are rewarded for responsibly disclosing security bugs.
"The first Hack the Pentagon challenge was a big, brave move by the DOD and Secretary of Defense Ash Carter," HackerOne CEO Marten Mickos, told eWEEK. "They knew it could be useful, but they couldn't know how useful. They also worried that it might backfire." As it turns out, the results of the initial Hack the Pentagon bug bounty program were very positive: 1,400 security researchers participated and 138 serious vulnerabilities were discovered that the DOD fixed quickly.
