ACLU: Feds should offer rewards for finding cybersecurity flaws

The American Civil Liberties Union is calling on federal officials to make it easier for people to report security flaws in government computer systems, including by offering rewards. The group told the Department of Commerce Internet Policy Task Force in a letter on May 27 to provide financial incentives for security researchers who bring flaws to the government's attention. Such rewards are common practice at large tech firms. “For far too long, researchers who discovered a security vulnerability have had to make a difficult choice: do the right thing -- by telling the company responsible for the software or warning the general public -- or sell the vulnerability, often to a government, which would then quietly exploit that flaw for its own gain,” the group said in its letter. “In an effort to disrupt this shadowy grey market and to provide some financial reward to researchers who notify the responsible vendor or developers, some leading technology companies have created 'bug bounty' programs.” The civil liberties group noted that the US government often pays researchers for vulnerabilities so that federal law enforcement can exploit them -- but does not offer payment for simply notifying developers about flaws in their work.