On Friday, Defense Secretary Ash Carter announced the results of the Hack the Pentagon program.
Carter personally thanked and awarded two of the program’s top researchers, including an 18-year-old high school student.
The Hack the Pentagon program began in March 2016, when the Department of Defense (DoD) announced it had begun a bug bounty program through the HackerOne platform.
Over 1,400 security researchers participated
The Department of Defense said that many security experts were involved, and the organization accepted over 1,400 researchers, who were given the green light to hack into the Department of Defense's public websites.
The program ran between April 18 and May 12, during which time the organization says they received at least one bug report from more than 250 (out of 1,400) security experts.
Of those, the agency validated 138 reports, and the researchers received a cash reward for their efforts.
The Department of Defense says their program cost the government only $150,000, with nearly half of that going to security researchers.
For comparison purposes, Carter noted that if the Department of Defense had hired a private security company, the total cost would have been over $1 million.
Following the success of the pilot program, Pentagon officials are already planning three more bug bounty programs, which are scheduled to launch next month.
Additionally, the Department of Defense DDS (Defense Digital Service) is also working on a vulnerability disclosure process and policy so that white hat researchers can report vulnerabilities within the bounds of the law.
At the press conference, Secretary of Defense Carter publicly thanked Craig Arendt, who was one of the program's lead researchers, and David Dworken, who is a student at Maret High School in Washington, DC.
In an interview with the American news website Metro, Dworken said that he spent most of his time “hacking the Pentagon” between classes. Dworken is no ordinary teenager, having been involved in similar bug bounty programs in the past
