Trump authorizes private US companies to launch cyber-attacks on foreign criminals

President Donald Trump signed a national security presidential memorandum on Wednesday that opens the door for private companies to take part in offensive cyber operations against foreign criminal organizations. The White House said the goal is to leverage private-sector capability and innovation to help conduct such operations under the direction, control and authority of the US government.

The move hands the private sector a role traditionally reserved for government agencies. The memo does not give companies unlimited hacking powers, but authorizes limited cyber operations carried out at the direction of the US government.

Background

International concern over cyber-attacks has grown as increasingly powerful artificial intelligence models have shown they can breach outdated security systems. Earlier this year, hackers targeted critical infrastructure in several US states, causing disruptions at water facilities. A White House fact sheet cited ransomware attacks, financial fraud and other crimes carried out by foreign-based criminal organizations, referred to in the memo as "transnational criminal organizations."

The administration had already signaled this direction in a national cybersecurity policy released in March, which said the government would create incentives to unleash the private sector against foreign adversaries. Legal experts have previously questioned what risks companies could face by becoming entangled in international digital conflicts.

How the program would work

The memo creates a framework encouraging private firms to enter agreements with other companies as well as federal, state, local, tribal and territorial agencies to gather threat information on these criminal organizations and propose cyber operations against them. The Department of Homeland Security has been directed to build a program, overseen jointly with the Department of Justice, to conduct specific operations disrupting these groups.

Once vetted, participating companies would carry out "cyber surveillance operations" and "cyber effects operations" against designated targets, potentially including manipulation, disruption, degradation or destruction of information systems and networks. Participants must maintain a bond or escrow of at least $1 million. The concept of private-sector involvement in such operations is not new, but has previously drawn controversy over fears of escalation and coordination problems between agencies.