Will Trump's cyber-security plan allow private companies to 'hack back'?

US President Donald Trump has announced plans to enhance the nation's cybersecurity by authorising private technology companies to take action against cyber attacks. However, cybersecurity experts are skeptical of the new approach. Trump's directive aims to capitalise on the innovative capabilities of American businesses to identify and disrupt criminal networks operating in cyberspace.

The White House argues that by partnering with vetted US companies subject to federal government direction and oversight, the country will bolster its ability to counter transnational cyber threats, crime, fraud, and predatory schemes targeting American citizens. The concept of "hack back," which involves private companies taking action against cyber-attackers, has been discussed in the cybersecurity community for the past 15 years.

Robert Graham, CEO of Atlanta-based cybersecurity firm Errata Security, criticises the proposal, stating that it merely directs law enforcement agencies to establish a list of actions private sector companies could undertake to enhance response times to hacks. Graham clarifies that companies do not have the authority to seize or profit from assets recovered from hackers.

A bill introduced in Congress last year would authorise the President to issue "letters of marque and reprisal" to private companies, providing them with more options to combat cybercrime. However, the bill did not advance beyond the committee stage, raising concerns about international sovereignty issues. Graham asserts that Trump's notice does not transform firms into cyber-security privateers, as no provisions exist for private companies to retain or profit from seized assets.