It is worth highlighting that there is a whole ecosystem of bottom feeders in the world of government contracted 'whitehat hackers' & 'consultants'. They know as much about security as one can pick from 'Hacking Exposed IV' kind of book from your local book store. Some of them are just fakes who just have the right connection within the agencies (many are just ex-employees, friends of friends, college buddies and cousins). Then they need to know how to navigate the red tape of proposals and bids. So this all amounts to a lot of waste, stupidity (at best) and down-right maliciousness (at worst). We saw some of this with HBGary and this Karim guy, and this is just the tip of the iceberg.
If you have the right connections and know how to handle the red-tape (you might have to hire a full-time professional for it), you can make quite a bit of money bullshitting the govt and selling them crap.