In 2013, an unusual post appeared on Mark Zuckerberg’s Facebook page. It was from a user called Khalil Shreateh.

“Dear Mark Zuckerberg,” Shreateh wrote, “Sorry for breaking your privacy, I had no other choice to make after all the reports I sent to Facebook.”

Shreateh, a security researcher from Palestine, had discovered a critical bug in Facebook’s software that allowed anyone to post directly on to any user’s wall. After he was ignored by the company’s security team, he took the direct approach to demonstrating the bug – hacking Mark Zuckerberg’s own page. While the incident showed the difficulties of getting cyber reporting right, Facebook has since become something of a pioneer in the growing field of “bug bounty” programmes.

Bug bounties pay freelance hackers to find flaws in software, and the potential rewards are only increasing.

High-profile hacks

Although some industries remain suspicious of so-called “white hat” hackers, bug bounties offer a way for companies to reward freelancers, review their research and deal with the problem safely. Inside companies there is a growing realisation that thinking like an attacker is the best defence against a real hack, and many are becoming more open to inviting them to test their systems.

“In some cases, researchers were running up against a brick wall trying to do the right thing,” says James Chappell, chief technology officer of UK cybersecurity company Digital Shadows, “a bug bounty programme takes the guesswork out.”

Bug bounties are almost as old as the internet itself and can be traced to Netscape in 1995. At Netscape, engineers proposed to executives the “Netscape Bugs Bounty Programme”, offering to reward the small army of Netscape fans publicly posting repairs and recommendations to fix problems with its browser.

But only recently have tech giants started budgeting millions of dollars to pay to be hacked. Facebook received 12,000 submissions from researchers in 2017, paying out $880,000 (£640,000). The company has now paid out a total of $6.3m to hackers since it started its programme in 2011.

The average reward also increased, growing to $1,900 from $1,675. While this is nothing to the company it is no small change to a freelancer, and it can help avoid embarrassing bugs that the in-house team might miss.

Google has also expanded its bug bounty programme significantly. Both Google and Facebook are unusually open about the work of their hacking community, in a world where many data breaches are hastily covered up.

Google has paid out $12m in rewards to hackers since 2010, paying $2.7m in 2017. Its biggest reward in 2017 was $112,500 to someone who exploited its Pixel smartphone. Following the recent Spectre and Meltdown bugs in its chips, Intel too has upped its top rewards to $250,000.