Cybersecurity

18F's procurement hack could guide DHS bug bounties

sphere of binary data

Take a page from the private sector and a page from the General Services Administration's 18F, and you might have the makings of a Department of Homeland Security bug bounty program.

The key could be a micro-purchasing authority through which feds can dodge the painful hiring and acquisition processes.

"We used it for code," said Darryl Peek, a cybersecurity strategist in DHS' Federal Network Resilience Division, of the micro-purchasing authority. "Why can't we use it for bounty?"

Peek was referencing 18F's successful efforts to buy coding work with reverse auctions under the micro-purchasing level of $3,500.

He acknowledged that directly hiring top talent would be preferable to paying outside professionals to detect vulnerabilities. But as antivirus legend John McAfee noted in a scathing Feb. 18 op-ed, government agencies "will not hire anyone with a 24-inch purple mohawk, 10-gauge ear piercings, and a tattooed face who demands to smoke weed while working and won't work for less than a half-million dollars a year." McAfee contends that those kinds of people are often the best tech talent.

For now, a serious conversation between DHS and 18F has yet to take place. "I don't know if it's even going to happen within the next year or so," Peek acknowledged, so a micro-purchase bounty program is just a gleam in his eye. (A DHS spokesman told FCW he didn't believe the department currently had any DHS bounty programs.)

"If there are people who are limited in their ability to [get hired by government], they're currently making money through Facebook, Google, Amazon, through the bounty program," Peek said. And he wants to bring those white-hat hackers into the government's fold.

"Why can't government set up a bounty program?" he asked. "Why can't our systems be just as robust as the Microsofts and the Apples and the Googles?"

About the Author

Zach Noble is a former FCW staff writer.

Featured

  • Defense

    DOD wants prime contractors to be 'help desk' for new cybersecurity model

    The Defense Department is pushing forward with its unified cybersecurity standard for contractors and wants large companies and industry associations to show startups and smaller firms the way.

  • FCW Perspectives
    tech process (pkproject/Shutterstock.com)

    Understanding the obstacles to automation

    As RPA moves from buzzword to practical applications, agency leaders say it’s forcing broader discussions about business operations

Stay Connected

FCW INSIDER

Sign up for our newsletter.

I agree to this site's Privacy Policy.