Panel: DEF CON to Help Hackers Anonymously Submit Bugs to the Government

DEF CON Hacker-to-Government Vulnerability Disclosure

Jeff Moss (The Dark Tangent) chairs a panel with Katie Moussouris (founder of Luta Security, architect of the first bug bounty programs at Microsoft and HackerOne) and Harley Geiger (Director of Public Policy, Rapid7) to announce a new DEF CON initiative to bridge the gap between the hacker community and US federal agencies on vulnerability disclosure.

The Problem: Lack of Safe Harbors

The panel outlines how security researchers remain reluctant to report vulnerabilities in government systems due to fears of prosecution under the Computer Fraud and Abuse Act (CFAA). Federal civilian agencies have no public vulnerability disclosure policies (VDPs), leaving hackers with no clear path to report issues without legal risk.

DEF CON's Role as Intermediary

DEF CON proposes acting as a trusted third party to receive researcher reports, strip identifying information, and pass validated findings to relevant agencies. This model draws on precedents from coordinated disclosure in the private sector.

Progress and Policy Outlook

The Binding Operational Directive (BOD) 20-01 is discussed as a near-term policy vehicle. Panelists urge CISA and OMB to mandate VDPs across all civilian agencies, creating clear safe harbor language so that good-faith research is protected.