U.S. launches 'Hack the Air Force' bug bounty program

The contest continues a trend within the U.S. military that began last year with Hack the Pentagon and Hack the Army.

The U.S. Air Force launched a new bug bounty program dubbed “Hack the Air Force” on Wednesday, continuing a trend within the U.S. military that began last year with Hack the Pentagon and Hack the Army.

Before the Pentagon’s bug bounty programs launched, it was illegal to search for vulnerabilities on Defense Department networks. Similar programs are popping up overseas: The U.K. launched a vulnerability coordination pilot program last month meant to improve the disclosure process and find more bugs on U.K. systems.

The Air Force program is directed by HackerOne, the bug bounty platform behind Hack the Pentagon that just raised a $40 million investment in February, and Luta Security, the security consulting firm driving the U.K. program. HackerOne and Luta Security are partnering to deliver up to 20 bug bounty challenges over three years to the Defense Department.

“This outside approach — drawing on the talent and expertise of our citizens and partner-nation citizens — in identifying our security vulnerabilities will help bolster our  cybersecurity,” Air Force Chief of Staff Gen. David Goldfein said in a statement. “We already aggressively conduct exercises and ‘red team’ our public facing and critical websites. But this next step throws open the doors and brings additional talent onto our cyber team.”

Bug bounty programs, which are credited in part for the increasing rarity of zero-day exploits, are widely adopted in the tech sector but still remain foreign to most large organizations.

“Not as many bug bounties are launching as one might think,” Katie Moussouris, founder of Luta Security, said. “In fact, while the numbers are increasing, most governments and even the largest Fortune 500 companies lack even the most basic vulnerability reporting capabilities.”

Meanwhile, dark net markets have launched bug bounty programs in an effort to harden their security against adversaries that might put them out of business or in prison.

Hackers from the United States, United Kingdom, Canada, Australia and New Zealand — the Five Eyes intelligence alliance — are eligible to participate in Hack the Air Force. Hackers must pass a rigorous background test and have a clean criminal record in order to participate. That excludes many talented individuals, some critics say, but close control is one of the common denominators across all of the Pentagon’s bounty programs.

Last year, the Pentagon awarded over $75,000 in bounties when more than 1,4000 participating hackers found 138 vulnerabilities in Defense Department systems.

Registration for Hack the Air Force begins on May 15. The contest launches on May 30 and will last until June 23.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure