I can think of a purely utilitarian reason to offer a bug bounty: Getting paid a bounty directly by the government is easier and safer than selling an exploit t

I can think of a purely utilitarian reason to offer a bug bounty: Getting paid a bounty directly by the government is easier and safer than selling an exploit to someone who will use it for criminal purposes. Granted that in an ideal world this sort of incentive wouldn't be necessary, but if we lived in an ideal world, code wouldn't have bugs in it, too. And another reason: If the government pays bounties for confirmed bug reports, a prospective reporter can have some confidence that they won't react to the report by taking punitive action, which might otherwise be a very real concern; HN periodically sees threads about employers and clients reacting extremely badly to unsolicited exploit reports, and the worst those can do stops short of imprisoning somebody. Of course, all of this assumes a government not so sclerotic that it'll take an interest in fixing bugs without first having to be motivated by a horribly embarrassing public compromise, which means it's probably not going to work in the UK, or for that matter in the US either. But it's a nice thought, I suppose.