Q:

What is an 'Orange team'?

I heard that Google had an unofficial 'Virtual' team called the Orange Team that consisted of staff from outside the official security team, who engaged in a range of white hat activities to both develop their own skills, and to improve security at Google. (sort of like a team of Dick Feynmans roaming Los Alamos)
Sadly I've had trouble identifying more information about defining the role and parameters of operation of an Orange Team so one could safely and effectively establish one.
Can anyone help; 

More clearly define the role of an Orange Team and its members?
Define what is acceptable practice?

In short, ensure team members can contribute to security safely, without endangering the organisation's security?

A:

There are a number of companies that do this. Typically, the organization defines the scope of the team, clearly defines the activities, trains and supervises. 
I have seen it done as part of the Security Awareness Champions programme that allows people who have been active in improving the security of their peers using the tools and processes available to everyone. This new level of training is a type of "reward" for being a leader in security among their peers. 
By tapping into the Champions programme, you give employees something to aim for and you get those who are truly showing interest in security and not those who are attracted only to the "hacking" part. 
After that, it all depends on what your organisation wants to tackle. I've seen phishing teams (phish your peers!), physical security teams (Mission Impossible your way into the building!), and application security teams (break our product!). 

