Hacker News Reader

Comment by flowerlad | Hacker News Reader

The government should offer a similar reward for information on US corporations who run critical infrastructure, or hoard personal information on US citizens, and don't maintain proper security.

View on HN

A government bug bounty program would be a huge step forward to our defense.

Could even encourage would be hackers to go white hat

The payout should come from the company that has the vulnerability, not US taxpayers. So basically there needs to be a law that states that if you run critical infrastructure, or hoard personal information on US citizens then you are required to set aside X dollars to pay white hat hackers who find vulnerabilities.

That might have the added benefit of incentivizing better security practices overall.

I wonder, is there a lobbying group that would or does support legislation like that? Maybe the EFF? I like the idea.

So basically all the credit rating agencies and the government itself? Or does the OPM get sovereign immunity? https://www.lawfareblog.com/why-opm-hack-far-worse-you-imagi...

How would you define "proper" security in a way that is enforceable in court?

Maybe the bar should be set to reasonable ongoing “effort”. It’s probably easier got a jury to judge at least an attempt equal the the stewardship of data they possess.

But valid point on “proper”.

Could it be following some sort of vetted requirement standard with authorised auditors? Something like PCI-DSS.

Maybe turn it into something like a game of capture-the-flag? Anyone who stores sensitive information must also store an unique flag value which, if reported to the 'referee' by an external actor would constitute proof of a security breach and requisite payout.

Reply on news.ycombinator.com