Perhaps there should be some sort of bug bounty on all government (at least federal, ideally state, and in a perfect world local) sites?  Would be awesome if, say, the US CTO spearheaded an effort to implement one.