4 ms·

The government should offer a similar reward for information on US corporations who run critical infrastructure, or hoard personal information on US citizens, a

The government should offer a similar reward for information on US corporations who run critical infrastructure, or hoard personal information on US citizens, and don't maintain proper security.

ixacto 5y ago
So basically all the credit rating agencies and the government itself? Or does the OPM get sovereign immunity? https://www.lawfareblog.com/why-opm-hack-far-worse-you-imagine https://www.lawfareblog.com/why-opm-hack-far-worse-you-imagi...
cgb223 5y ago
A government bug bounty program would be a huge step forward to our defense. Could even encourage would be hackers to go white hat
- flowerlad 5y ago
  The payout should come from the company that has the vulnerability, not US taxpayers. So basically there needs to be a law that states that if you run critical infrastructure, or hoard personal information on US citizens then you are required to set aside X dollars to pay white hat hackers who find vulnerabilities.
  - sircastor 5y ago
    That might have the added benefit of incentivizing better security practices overall.
  - smolder 5y ago
    I wonder, is there a lobbying group that would or does support legislation like that? Maybe the EFF? I like the idea.
mikewarot 5y ago
How would you define "proper" security in a way that is enforceable in court?
- social_quotient 5y ago
  Maybe the bar should be set to reasonable ongoing “effort”. It’s probably easier got a jury to judge at least an attempt equal the the stewardship of data they possess. But valid point on “proper”.
  - okamiueru 5y ago
    Could it be following some sort of vetted requirement standard with authorised auditors? Something like PCI-DSS.
- thereisnospork 5y ago
  Maybe turn it into something like a game of capture-the-flag? Anyone who stores sensitive information must also store an unique flag value which, if reported to the 'referee' by an external actor would constitute proof of a security breach and requisite payout.

The government should offer a similar reward for information on US corporations who run critical infrastructure, or hoard personal information on US citizens, and don't maintain proper security.

ixacto 5y ago

So basically all the credit rating agencies and the government itself? Or does the OPM get sovereign immunity? https://www.lawfareblog.com/why-opm-hack-far-worse-you-imagine https://www.lawfareblog.com/why-opm-hack-far-worse-you-imagi...

cgb223 5y ago

A government bug bounty program would be a huge step forward to our defense. Could even encourage would be hackers to go white hat

flowerlad 5y ago
The payout should come from the company that has the vulnerability, not US taxpayers. So basically there needs to be a law that states that if you run critical infrastructure, or hoard personal information on US citizens then you are required to set aside X dollars to pay white hat hackers who find vulnerabilities.
- sircastor 5y ago
  That might have the added benefit of incentivizing better security practices overall.
- smolder 5y ago
  I wonder, is there a lobbying group that would or does support legislation like that? Maybe the EFF? I like the idea.

mikewarot 5y ago

How would you define "proper" security in a way that is enforceable in court?

social_quotient 5y ago
Maybe the bar should be set to reasonable ongoing “effort”. It’s probably easier got a jury to judge at least an attempt equal the the stewardship of data they possess. But valid point on “proper”.
- okamiueru 5y ago
  Could it be following some sort of vetted requirement standard with authorised auditors? Something like PCI-DSS.
thereisnospork 5y ago
Maybe turn it into something like a game of capture-the-flag? Anyone who stores sensitive information must also store an unique flag value which, if reported to the 'referee' by an external actor would constitute proof of a security breach and requisite payout.