3 hours ago

The state could financially reward people who discover computer vulnerabilities in public institutions / The bill has passed the Senate and is heading to the Chamber of Deputies

Raluca Ioana Draghici

2 November 2026, 19:40

Politics

shutterstock.com

Always see our news on Google

On Monday, November 2, 2026, the Senate adopted a bill allowing the National Directorate for Cyber Security (DNSC) to organize “bug bounty” programs for the computer networks and systems of public authorities and institutions. Specialists who identify and report real, validated vulnerabilities would receive financial rewards.

The mechanism allows experts to legally and in a controlled manner test public systems so that security gaps can be fixed before being exploited by attackers. Participation will be possible only with the prior, express, written consent of all owners or administrators of the systems concerned. The authorization will specify the components that may be tested and the limits of the checks.

The bill prohibits unauthorized access to, copying, deletion or alteration of data, brute-force attacks, phishing, the use of malware, and retaining access after the authorization expires. Vulnerabilities may be disclosed only through coordinated procedures. Violating the rules results in the loss of the authorization and the reward, without removing any potential legal liability.

The initiative supplements the framework established by Government Emergency Ordinance 155/2024 and Law 124/2025. The bill now goes to the Chamber of Deputies, the decision-making chamber.

ُ,

Context: Romania is gradually strengthening its cybersecurity framework and the obligations of public institutions

Previously, the Senate extended until December 31, 2035, the ban on the acquisition, installation, and use of software products and services from Russia by public authorities, a measure justified by the security risks related to the invasion of Ukraine by the Russian Federation. In parallel, the law was also supplemented with rules for the cooperation of authorities with digital service providers: the Senate adopted a bill requiring such companies to designate a headquarters or legal representative in an EU member state so that authorities can access electronic evidence more easily.

Regarding practical accountability, DNSC also imposed sanctions: an institution in the central public administration was fined 50,000 lei because it failed to report a cybersecurity incident in time, and the directorate emphasized that rapid notification is essential for managing and limiting the effects.

At the same time, the Chamber of Deputies adopted a bill allowing investments in the cybersecurity of networks to be included in energy and gas bills, with the technical rules and plan verification to be developed by DNSC, while amendments to the tariff-setting methodologies are to be managed by ANRE.