President Trump has introduced a memorandum aiming to involve private companies in combatting cybercrime, traditionally a role for government agencies. The idea permits certain U.S. businesses, approved by the government, to target foreign cybercriminals. Historically, such tasks have been managed by federal entities.
Details of the Memo
The memorandum does not legally authorize private companies to engage in spying or disruptive cyber activities. U.S. laws currently limit hacking activities, typically reserving such actions for law enforcement. The memo insists that private firms participating must be contracted through the federal government. If enacted, it would enable select businesses to disrupt foreign entities labeled as cybercriminals by the government or collect intelligence on these groups.
Joshua Steinman, former senior director for cyber policy on the National Security Council, mentioned potential targets could include organized crime groups engaged in money laundering or other illicit activities. Despite lacking full authority for private companies, the memo aligns with legislative efforts by Republican congressmen proposing the use of cyber “privateers.”
Potential for Private Sector Involvement
The memorandum leaves questions on which companies might consider this opportunity. Private firms with existing government contracts have not directly engaged in digital sabotage, but rather in supportive roles. Arthur Tellis, a fellow at the Institute for Progress and former Defense Department staffer, believes many firms will perceive this as a chance to expand their governmental work.
Participating companies would, after rigorous vetting, contract with either the Department of Justice or Homeland Security. They would need to set aside $1 million that the government can reclaim if obligations are unmet. These companies can then engage with foreign computer networks to disrupt or manipulate information systems, though specifics on the process remain vague in the memo.
Industry Reactions
Some industry members view the initiative skeptically. Paul Rosenzweig, who heads a consulting firm and has past experience in homeland security, argues the initiative might pose legal challenges for private actors hacking foreign entities. He notes hacking activities overseas risk violating numerous countries’ domestic laws. The internet operates without clear sovereign boundaries, complicating such engagements.
Chris Wysopal, a co-founder of security firm Veracode, expressed concerns about legal liabilities and potential collateral damage for companies undertaking these cyber operations.
The Cyberattack Threat
Cyberattacks cause significant financial losses each year. They affect private companies and public utilities alike, threatening to expose data unless ransoms are paid. A recent attack in Minnesota targeted over 30 water systems, reportedly linked to Iranian actors. These events underline the national security risks cybercrime presents.
Former Trump official Steinman believes involving the private sector in offensive cyber capabilities could be beneficial if approached cautiously. However, some experts caution that increased offense will not solve cybercrime alone. New threats perpetually emerge, making a purely offensive strategy insufficient for lasting security.
Leave a Reply