The US government is preparing to fundamentally change the role of private cybersecurity companies. Under a new presidential memorandum, vetted American firms will be allowed to conduct offensive cyber operations against foreign criminal groups. The move represents a major departure from decades of policy that treated hacking back as off-limits for private entities.

According to the memorandum, the program will be overseen by the Justice Department and the Department of Homeland Security. Companies that wish to participate must undergo a vetting process and receive written approval for each operation. The operations can include surveillance, disruption, manipulation, degradation, or even destruction of computer systems and data belonging to foreign cybercriminal organizations.

This is a significant escalation in the fight against ransomware, fraud, and other cybercrimes targeting American citizens and businesses. Instead of only defending networks and cleaning up after breaches, private cybersecurity firms may soon be authorized to take the fight directly to the attackers.

Key Facts of the New Program

• The US is creating a federal program that lets vetted private companies conduct offensive cyber operations against foreign criminal groups.
• Every operation will require written approval from program directors at the Justice Department and the Department of Homeland Security.
• Participating companies may be required to put up at least $1 million in a bond or escrow account, which could be forfeited if they break the rules.
• The memorandum allows operations that can manipulate, disrupt, degrade, or destroy computer systems and data, as well as surveillance operations that involve secretly accessing systems without the owner's permission.
• Officials have 60 days to establish the operating procedures and precise rulebook for the program.

How the Program Would Work

Under the memorandum, companies participating in the program will not be given unrestricted authority. Each operation must be individually approved by designated directors at the Justice Department and the Department of Homeland Security. The companies will operate under federal supervision, and any deviation from the approved scope could result in severe penalties, including forfeiture of the escrow funds.

The requirement for a $1 million bond or escrow account is intended to ensure accountability. If a company violates the terms of its authorization or causes unintended harm, that money could be seized. This provision acknowledges the high-risk nature of offensive cyber operations and aims to deter reckless behavior.

There are also guardrails to protect American interests. The program is explicitly designed to target foreign criminal groups rather than foreign governments. If an operation accidentally targets a US person or a US-based system, the company must stop immediately and report the incident to federal authorities. This is a critical safeguard given the difficulty of attributing cyber activity with precision.

A Major Policy Shift

For years, the US government has maintained a clear line: private companies can defend against hackers, but they cannot launch offensive attacks. This policy was rooted in concerns about vigilante justice, escalation, and the potential for collateral damage. The new memorandum erases that line, at least for a select group of vetted companies operating under federal oversight.

The shift is driven by the growing scale and sophistication of cybercrime. Ransomware attacks have disrupted hospitals, pipelines, schools, and government agencies, causing billions of dollars in damage. Traditional defense and law enforcement methods have not been enough to deter these criminal groups, many of which operate from countries with weak cyber enforcement or tacit government support.

By empowering private companies to go on the offensive, the US government is acknowledging that the private sector may be better positioned to disrupt criminal networks quickly. These firms often have deep expertise in the tactics, techniques, and procedures used by hackers, as well as access to threat intelligence that government agencies may lack.

Industry Reactions and Concerns

Cybersecurity experts have reacted with a mix of cautious optimism and serious concern. Some view the program as a necessary evolution in the fight against cybercrime, arguing that the current rules give attackers a safe haven. Others worry that the plan is poorly defined and could create legal and diplomatic problems.

Jake Williams, a well-known cybersecurity veteran, described the plan as “half-baked.” He warned that Americans involved in these operations could face legal trouble or accusations from foreign governments when traveling overseas. Because offensive cyber operations may violate the laws of the countries where the targets are located, participating companies and their employees could be exposed to prosecution abroad.

There are also concerns about whether private companies have the discipline and accountability to conduct operations that often require split-second decisions. Unlike government intelligence agencies, which have decades of experience with covert operations and legal review, private firms are driven by profit and may face conflicts of interest.

Historical Context: The Longstanding Ban on Hacking Back

The prohibition on hacking back is not a casual policy; it is deeply embedded in US law and practice. The Computer Fraud and Abuse Act, first enacted in 1986, makes it illegal to access computer systems without authorization. While it is primarily used to prosecute hackers, it also applies to victims who attempt to hack back against their attackers.

For years, cybersecurity firms have argued that the law is outdated and leaves victims defenseless. They have pushed for legislation that would allow some form of active defense. However, previous attempts to pass such laws failed due to concerns about escalation, misattribution, and the danger of accidentally harming innocent systems.

The new memorandum bypasses legislation by using executive authority. It creates a pilot program that grants specific authorizations to vetted companies, effectively creating a legal pathway for hacking back that did not exist before. This approach has its own risks, as it could be overturned by a future administration or challenged in court.

The Challenge of Attribution and Collateral Damage

One of the biggest challenges in cyber operations is attribution. It can be extremely difficult to know with certainty who is behind an attack. Criminal groups often hide behind compromised servers, anonymity tools, and infrastructure located in multiple countries. The memorandum requires that operations target foreign criminal groups, but making that determination accurately is no small feat.

If the attribution is wrong, the consequences could be serious. A company might attack systems belonging to an innocent business, a foreign government, or even another US agency. The guardrail requiring immediate notification of any accidental US target is helpful, but the damage may already be done by then.

The memorandum also requires companies to stop operations that accidentally target US persons or systems, but it does not clearly define what happens if a foreign government is accidentally hit. Criminal groups often operate with some degree of impunity in countries where law enforcement is weak or corrupt, and they may use government infrastructure to launch attacks. Navigating these gray zones will be a monumental challenge for the program directors.

Financial and Legal Implications for Participating Companies

Participating in the program will not be cheap or easy. The $1 million escrow requirement is just the beginning. Companies will need to hire lawyers, cyber insurance specialists, and compliance officers to ensure they meet the federal government's standards. They will also need to invest heavily in operational security to protect their own systems from retaliation.

Retaliation is a significant risk. Criminal groups that are attacked by private companies might not simply disappear. They may respond by targeting the company's employees, customers, or infrastructure. The memorandum does not outline how the US government will protect participating companies from such retaliation, leaving a major question mark over the program's viability.

Despite these challenges, some companies are likely to step forward. The program offers an opportunity to shape a new frontier in cybersecurity and to profit from the demand for offensive capabilities. But the risks are substantial, both professionally and personally for the people involved.

What Happens Next

The memorandum gives federal officials 60 days to establish the operating procedures for the program. During this time, the Justice Department and the Department of Homeland Security will need to craft detailed rules on everything from target selection to post-operation reporting. They will also need to determine how companies are vetted and what specific qualifications they must meet.

The program's future will depend on how these rules are written and how effectively they are enforced. If the program can demonstrate that it disrupts cybercrime without causing major incidents, it may become a permanent part of the US cybersecurity strategy. If it fails, it will likely be remembered as a risky experiment that went wrong.

For now, the announcement sends a clear signal to the world: the US government is no longer content to let private cybersecurity companies sit on the defensive. By empowering them to attack foreign criminals, the United States is entering a new era of active cyber defense. The coming months will determine whether that era is defined by success or by cautionary tales.

Source:Android Authority News