Trump memo lets vetted US firms run offensive cyber operations abroad

President Donald Trump signed a national security presidential memorandum on Wednesday that permits vetted private companies to carry out hacking operations against foreign criminal groups. This memorandum, titled "Expanding Capabilities to Combat Transnational Cyber-Enabled Crime," instructs the Homeland Security Task Force's National Coordination Center to establish the program.

The program will be overseen by executives from the Justice Department and Homeland Security. Companies approved to participate in the program may conduct cyber surveillance and cyber effects operations, which involve disrupting or destroying a target's systems. However, companies do not receive unrestricted authority and must sign a contract with either the Justice or Homeland Security Department, subject to rigorous screening for technical proficiency, facility security, and personnel background.

Before initiating any operation, a written sign-off is required. Violation of the program's terms results in the forfeiture of a bond of at least $1 million. The program's operating procedures must be published within 60 days, including the adjudicatory framework for selecting targets. Programs aimed at causing death or serious injury, as well as those considered a use of force under international law, are prohibited.

Any operation exceeding approved parameters must cease immediately. The Computer Fraud and Abuse Act remains applicable. While some have proposed legalizing hack-back, including a failed 2017 and 2019 version of the Active Cyber Defense Certainty Act, the White House estimates that cyber-enabled crime costs U.S. consumers $20.8 billion annually, with 73% of U.S. adults having been victims of online scams or attacks.

The memorandum extends Executive Order 14390, signed by Trump on March 6, "Combating Cybercrime, Fraud, and Predatory Schemes Against American Citizens." Experts have raised concerns about the difficulty of striking back without causing unintended collateral damage, as adversary infrastructure often burns down quickly. Moreover, adversaries launch attacks from compromised, innocent infrastructure rather than labeled servers.