State Department is offering big rewards for info on hackers, to uncertain ends

And that State Department “Rewards for Justice” initiative is set to advertise new targets between now and the 2022 midterm elections, officials told me, speaking on the condition of anonymity due to the sensitivity of their work.

Rewards for Justice, which is housed within the Diplomatic Security Service and has for decades focused primarily on countering terrorism, expanded in 2020 to start going after election interference and hacking of U.S. critical infrastructure. 

But Diplomatic Security Service (DSS) officials wouldn’t say whether anyone has cashed in on those post-2020 rewards, citing the need to protect sources. One Capitol Hill aide, speaking on the condition of anonymity because they aren’t authorized to speak publicly, told me that they’re “not aware of any major success stories” related to hacking and election security.

That might just be a matter of lag time. It can take months or even years, DSS officials said, to reap the best tips. And while some doubt the program’s ability to help chase down hackers or election meddlers, many still think Rewards for Justice can help in other ways.

• “The way to judge it isn’t how many people we catch,” James Lewis, a cybersecurity expert at the Center for Security and International Studies who once served at the State Department, told me. “It’s how much we get the message out there. … As part of a larger U.S. effort to finally begin to impose consequences, it’s a good thing.”

The State Department says that Rewards for Justice has paid out $250 million to more than 125 people since its inception in 1984 and has highlighted a select few success stories on its website. Congress has, in recent years, authorized the program to move into election security and cybersecurity. (It’s not the only program to offer rewards for information about illicit hacking, or even the only program in the State Department to do so.)

But the program hasn’t always proven successful. It had trouble getting tips on al-Qaeda in the early 2000s, as The Post reported in 2008.

Two DSS officials spoke with me about the inner workings of the program. Analysts evaluate tips for useful information, possibly contacting the source for clarification, then pass good tips along to others in U.S. intelligence, security and law enforcement agencies to handle the cases. Approximately 90 percent of the tips are “unusable trash,” and just 2 to 4 percent of what comes in “may be useful,” one official said. It won’t say much about the tipsters otherwise.

“Foreign governments … can be very dangerous to the tipster, so we don’t like to talk about what comes in,” the official said.

Since 2008, the program has improved its outreach with technology, one of the officials told me. What once was just a 1-800 line, an email address and an online form has expanded to include tip lines on the dark web, Signal, WhatsApp and more. 

“We’ve seen quite an uptick in the quality of things coming in because we make it easier and more secure,” the official said.

While the officials said there’s been a learning curve about how they market the program to get tips on hackers and election meddlers, they’ve embraced the power and reach of social media.

The August reward offer for Conti was the first time the U.S. government publicized a picture of a suspected Conti hacker, and the Rewards for Justice Twitter account playfully mocked them.