DoD bug bounty program to expand to more sensitive systems

This article has been updated to reflect additional details regarding the nature of the contract.

In yet another contract allowing outside hackers to test systems for vulnerabilities, the Department of Defense is opening the doors to more sensitive systems.

Bug bounties, as they’re known, have focused on both public-facing DoD websites and internal systems. They allow vetted hackers to search for vulnerabilities for cash payouts that will later be fixed.

DoD is expanding the work on its more sensitive systems to more companies, with vulnerability disclosure company HackerOne "run[ning] bug bounties on a broader range of assets such as hardware and physical systems,” a release by the company said.

Declining to offer specifics on these systems, HackerOne CEO Marten Mickos told Fifth Domain that the contract will focus on DoD systems that are more critical and maybe more sensitive.

“We are stepping one step into more sensitive systems. We started from the very public ones, demonstrated amazing, amazing success there, so therefore [DoD is] saying let’s apply this same model and the same vendor to the more sensitive systems that we have,” he said.

Mickos added that this new contract, which is up to $34 million across three vendors (including Synack and Bugcrowd) is a natural expansion signaling all the successful steps taken from the initial Hack the Pentagon effort in 2016. Over the years that program has resulted in the identification of 5,000 security vulnerabilities that DoD has fixed.

The Defense Digital Service has been the shepherd internal to the department working to make the vulnerability disclosure program a reality.

“Finding innovative ways to identify vulnerabilities and strengthen security has never been more important,” said Chris Lynch, director of the Defense Digital Service.

“When our adversaries carry out malicious attacks, they don’t hold back and aren’t afraid to be creative. Expanding our crowdsourced security work allows us to build a deeper bench of tech talent and bring more diverse perspectives to protect and defend our assets. We’re excited to see the program continue to grow and deliver value across the department.”

More In

New US Space Force jammers aim to disrupt China’s SATCOM signals

The Remote Modular Terminals, which disrupt adversary satellites by "yelling in their ear," as one official put it, are cleared for initial fielding,

Space Force must grow to counter China and Russia, lawmaker says

House Armed Services Chairman Mike Rogers, R-Ala., said the service is not sized to meet increasing threats from China and Russia.

SpaceX launches rapid response GPS mission

The effort, dubbed Rapid Response Trailblazer, was meant to demonstrate the ability to quickly plan and launch a mission in around six months.

Space Command strategy aims to boost commercial role in operations

The updated strategy, approved in November, focuses on SPACECOM’s core tasks and how commercial space capabilities fit within those areas.

German Navy tests BlueWhale underwater drone for covert ship tracking

“This a capability currently only available via manned submarines, which makes it significant for maritime surveillance,” officials said.