18F's procurement hack could guide DHS bug bounties
- By Zach Noble
- Feb 19, 2016
Take a page from the private sector and a page from the General Services Administration's 18F, and you might have the makings of a Department of Homeland Security bug bounty program.
The key could be a micro-purchasing authority through which feds can dodge the painful hiring and acquisition processes.
"We used it for code," said Darryl Peek, a cybersecurity strategist in DHS' Federal Network Resilience Division, of the micro-purchasing authority. "Why can't we use it for bounty?"
Peek was referencing 18F's successful efforts to buy coding work with reverse auctions under the micro-purchasing level of $3,500.
He acknowledged that directly hiring top talent would be preferable to paying outside professionals to detect vulnerabilities. But as antivirus legend John McAfee noted in a scathing Feb. 18 op-ed, government agencies "will not hire anyone with a 24-inch purple mohawk, 10-gauge ear piercings, and a tattooed face who demands to smoke weed while working and won't work for less than a half-million dollars a year." McAfee contends that those kinds of people are often the best tech talent.
For now, a serious conversation between DHS and 18F has yet to take place. "I don't know if it's even going to happen within the next year or so," Peek acknowledged, so a micro-purchase bounty program is just a gleam in his eye. (A DHS spokesman told FCW he didn't believe the department currently had any DHS bounty programs.)
"If there are people who are limited in their ability to [get hired by government], they're currently making money through Facebook, Google, Amazon, through the bounty program," Peek said. And he wants to bring those white-hat hackers into the government's fold.
"Why can't government set up a bounty program?" he asked. "Why can't our systems be just as robust as the Microsofts and the Apples and the Googles?"
Zach Noble is a staff writer covering digital citizen services, workforce issues and a range of civilian federal agencies.
Before joining FCW in 2015, Noble served as assistant editor at the viral news site TheBlaze, where he wrote a mix of business, political and breaking news stories and managed weekend news coverage. He has also written for online and print publications including The Washington Free Beacon, The Santa Barbara News-Press, The Federalist and Washington Technology.
Noble is a graduate of Saint Vincent College, where he studied English, economics and mathematics.
Click here for previous articles by Noble, or connect with him on Twitter: @thezachnoble.