The Trump administration has announced a new initiative that will allow private cybersecurity firms to conduct offensive operations against cybercrime organizations, working in conjunction with the Justice Department and the Department of Homeland Security. A presidential memorandum released on Wednesday outlines the framework for these partnerships, which aim to disrupt “transnational cybercrime, fraud, and other predatory schemes against American citizens.”
The memorandum emphasizes that any cyber operations undertaken by private companies must receive advance approval from DOJ and DHS officials. Strict limitations are imposed, prohibiting any operation that could lead to loss of life or actions that would be considered a use of force or armed attack under international law. Each proposed cyber operation package will undergo a review and require written approval and direction from federal officials before execution.
This new policy builds upon a March executive order that called for a more aggressive stance against cybercrime, which reportedly cost American consumers $20.8 billion in losses last year. The administration seeks to leverage the “ingenuity of the private sector,” asserting that American businesses have been underutilized in efforts to identify and dismantle criminal networks operating in cyberspace. National Cyber Director Sean Cairncross had previously hinted at the potential for private sector involvement in offensive cyber operations.
Participating companies will enter into contracts with either the DOJ or DHS and will undergo a rigorous vetting process to ensure adherence to strict operational procedures. They will gain access to threat intelligence to aid their operations and will collaborate with federal, state, and local authorities. Federal agencies have a two-month deadline to develop operating procedures and establish minimum standards for companies, covering aspects such as technical proficiency, proven performance, facility security, personnel vetting, competence, and reliability.
A framework for target identification will be created by DHS and DOJ, and companies will be required to report their activities to the federal government regularly. While the White House has not confirmed if any companies have already committed, the memorandum indicates a search for both large and small firms to participate. Companies must disclose all contractual relationships to the government and face a penalty of at least $1 million for any violation of the agreement. Annual evaluations will determine continued participation in the program.
The memorandum also addresses scenarios where operations might inadvertently impact U.S. persons, information systems within the U.S., or systems controlled by U.S. persons. In such cases, companies must cease the operation, conduct minimization procedures, and immediately notify the National Cyber Director, who will then inform the Department of Justice. Furthermore, companies are obligated to notify the federal government if they discover an imminent cyberattack against U.S. critical infrastructure or a plot that could result in loss of life.
Concerns have been raised by some cybersecurity experts regarding the lack of explicit legal protections for employees involved in these operations and the potential for foreign governments to target them directly. Questions have also emerged about protocols for mistakes or misidentified targets, and the implications for U.S. employees given recent international arrests related to alleged state-sponsored cyber activities. The memorandum does not detail how situations involving cybercriminal organizations with ties to nation-state hacking groups or government entities will be handled, despite recent State Department statements linking some Chinese scam gangs in Southeast Asia to Chinese government projects and DOJ indictments implicating Cambodian and Myanmar government officials in transnational criminal organizations.
