Maybe they can fund improving of standards and, for example audits of widely used open source projects. Also some give some protection for people who find vulne

Maybe they can fund improving of standards and, for example audits of widely used open source projects. Also some give some protection for people who find vulnerable systems: legal threats should not be an acceptable response to reporting security issues. I understand that the government is interested in having security holes to exploit, but you need to choose. A program to fix municipal and state IT systems security should help too.