US will allow private firms to conduct cyberattacks

Reverses a longstanding policy of defence only

Cyberattack and internet crime, hacking and malware concepts. Digital binary code data numbers and secure lock icons on hacker' hands working with keyboard computer on dark blue tone background.

A new presidential memo gives some US companies the right to carry out cyberattacks against America’s enemies.

Vetted private firms will be allowed to perform “offensive cyber operations” against international criminal groups, according to the memo published on Wednesday.

For these purposes, a "Cyber-Enabled Transnational Criminal Organisation” includes any non-state foreign group conducting cyber operations against the US government, a US citizen or the country’s interests.

All participating companies will need to be vetted, and any operations – which could range from surveillance to disruption – will be subject to approval by the federal government.

The move is a significant shift in how the USA treats cyberattacks. Under the Computer Fraud and Abuse Act (CFAA), private companies are only allowed to defend themselves, not launch or operate offensive operations. This memo appears to create a government-authorised route around that longstanding ban.

The White House writes that “American businesses’ innovative capabilities have historically been underutilised in efforts to identify and disrupt criminal networks operating in cyberspace.”

The new policy will "enhance our ability to counter TCO threats and combat transnational cybercrime, fraud, and other predatory schemes against American citizens.”

However, while the memo sets out the policy, it does not provide firm legal definitions, guidance, vetting standards or operating procedures. These will apparently be released within the next two months.

Here’s what we know so far:

Participating private companies will be vetted by the US government and must deposit $1 million in escrow, which they will forfeit if they don’t follow the rules (such as conducting operations against domestic targets);
All operations are to be signed off by representatives from the Justice Department and Homeland Security, and will require oversight by the federal government; but
Programme directors may not approve operations that are expected to cause “critical outcomes” such as death or serious injury.
Participating companies will be able to conduct both cyber surveillance and cyber effects operations. The latter includes “manipulation, disruption, denial, degradation, or destruction” of systems, networks, infrastructure or data.
They will also be able to work with other private entities and government agencies to gather and share data, primarily threat intelligence.

The memo has already proven controversial. Critics of private hacking have long argued that such a move could have diplomatic ramifications, or even open the door to indictments.

“Americans participating in these operations could easily be classified as non-uniformed combatants while traveling overseas,” said Jake Williams of Hunter Strategy.

Arrests could happen even without evidence that an individual has participated in such an operation; just the possibility that they could have done so may allow foreign governments to level accusations.