Trump to let some private firms carry out global cyberattacks
What's the story
The Trump administration has announced a groundbreaking initiative, allowing select private companies to conduct offensive cyber operations against foreign criminals. The move, first reported by Bloomberg, is aimed at leveraging the "innovative capabilities of the private sector" in combating cybercrime and threats to Americans. These include ransomware attacks, financial scams, and sextortion.
Operational details
Operations include surveillance and data destruction
The newly introduced policy permits private companies in the government's program to carry out surveillance and disruptive attacks.
This includes using spyware for intelligence gathering and launching attacks aimed at destroying data or systems of criminals.
However, these operations will be conducted only with the federal government's approval and oversight.
Regulatory framework
Oversight and requirements for private companies
The Department of Justice and Department of Homeland Security will oversee these private firms.
They will have to meet requirements in "technical proficiency, proven performance of cyber operations, facility security," among others.
Companies in the program must also hold a bond or escrow of at least $1 million that they would forfeit if they fail to comply with their contractual agreement.
Risk assessment
Legal risks and potential pitfalls
Despite the potential benefits, experts have raised concerns about the risk of private firms being drawn into geopolitical or legal conflicts.
Jason Healey, a senior cyber conflict researcher at Columbia University, warned that "Anyone conducting these operations is doing so at substantial personal legal risk."
Jake Williams, the vice president of research and development at Hunter Strategy, echoed this sentiment by saying "Americans participating in these operations could easily be classified as non-uniformed combatants while traveling overseas."
Collateral risks
Concerns over collateral damage
Ben Bernstein, a manager for the cybersecurity advisers team at Huntress, raised concerns over the potential for collateral damage in these operations.
He said, "Threat actors don't launch attacks from labeled servers in Moscow; they route traffic through compromised, innocent infrastructure."
This makes it nearly impossible to retaliate without harming innocent bystanders.
The US government had previously conducted its own cyber operations instead of outsourcing them to third parties.