Trump wants to grant private cyber firms a license to hack back

President Donald Trump authorized government agencies to enlist private cybersecurity firms to conduct operations against cybercrime syndicates targeting the United States. In a memo signed on Wednesday, Trump confirmed a strategy unveiled earlier in the year, stating that these companies could support national efforts against criminals, including cyber surveillance and interference with their systems and networks.

Cyber Effects Operations, a term used in the memo, refers to activities that manipulate, disrupt, deny, degrade, or destroy information systems, networks, or infrastructure reliant on them. While the memo separates cyber effects operations from cyber surveillance missions, it acknowledges the latter's indirect impact on systems to gather intelligence for subsequent cyber effects operations, which must remain undercover.

Trump defined cyber-enabled transnational criminal organizations (CE-TCOs) as foreign groups that commit cyber-enabled crimes against the U.S. government, a U.S. individual, or U.S. interests, excluding entities wholly controlled by foreign governments. Participating firms must undergo thorough screening and adhere to strict procedures developed within 60 days, overseen by program executives working with the Homeland Security Council.

Companies must prove their technical capabilities annually through evaluations. The Justice Department will also authorize operations, particularly those targeting U.S. residents or raising domestic legal concerns. Participating firms are barred from executing operations that could result in lethal or serious harm, or those considered armed attacks under international law.

Additionally, they must maintain a bond or escrow of at least $1 million, forfeitable for contract violations. The White House's cyber strategy, published in March, aimed to empower the private sector by incentivizing the identification and disruption of adversary networks and strengthening national capabilities. The announcement generated discussions about the implementation of this plan, with experts suggesting that American companies could support operations against nation-states only after legal and regulatory amendments.