Donald Trump empowers US private companies to conduct cyber-attacks

President Donald Trump signed a memorandum on Wednesday, bestowing private sector companies with the authority to conduct offensive cyber-attacks against transnational criminal organizations. The White House explained that the policy aims to harness the innovation and capability of the private sector in combating cyber threats, under the guidance of the U.S. government.

This shift in authority marks a significant change, previously confining such operations to government agencies. The new regulation does not grant firms unlimited hacking rights but permits "limited cyber operations at the direction of the US government." The surge in cyber-attacks, exacerbated by the advent of advanced artificial intelligence models, has prompted the shift; previous incidents, such as targeted cyberattacks on critical infrastructure systems in several U.S. states, underscore the urgency.

The memo cites ransomware attacks, financial frauds, and other crimes perpetrated by foreign-based criminal organizations, termed "transnational criminal organizations" (TCOs) in the document. The Trump administration has previously advocated for a larger role for private firms in cybersecurity operations, with a 2022 national cybersecurity policy emphasizing incentives to empower the private sector against foreign adversaries.

However, legal experts have expressed concerns over potential risks and liabilities that companies might face in international digital conflicts. The memorandum from the White House establishes a framework encouraging private sector companies to collaborate with other private entities and federal, state, local, tribal, and territorial agencies to gather threat intelligence on transnational criminal organizations and propose cyber operations to counter these threats.

The Department of Homeland Security (DHS), via its national coordination center, is tasked with launching a program to execute specific cyber operations that disrupt foreign TCOs, supervised by both the DHS and the Department of Justice. Participating companies, once vetted, will engage in "cyber surveillance operations" and "cyber effects operations" against designated targets, according to the memo.

Cyber effects include actions like manipulating, disrupting, denying, degrading, or destroying information systems, networks, physical, or virtual infrastructure controlled by information systems. Companies must maintain a bond or escrow of at least $1 million, as stipulated in the memo. While the concept of private sector firms engaging in cyber operations against criminal and other entities is not entirely novel, it has previously faced criticism over potential escalation, unintended consequences, and inter-agency coordination challenges. The DHS and the White House have not yet provided additional details about the program.