Will Trump's cyber-security plan allow private companies to 'hack back'?

US President Donald Trump is looking to bolster the fight against cybercrime by allowing private-sector computer security firms to take action, but experts argue the concept is nothing new. In a notice issued on Wednesday, Trump highlighted the US technology sector's innovation and technological prowess, urging it to not be sidelined amidst an increase in cyber attacks against the nation.

He suggested that American businesses' capabilities in identifying and disrupting criminal networks operating in cyberspace have not been fully utilized. By collaborating with vetted US companies under federal guidance, the aim is to boost the ability to counter threats from transnational criminal organizations and combat cyber crime, fraud, and other predatory schemes targeting American citizens.

This approach echoes the term "hack back," which has been discussed in the cybersecurity community for the past 15 years.

Robert Graham, CEO of Atlanta-based cybersecurity firm Errata Security, expressed skepticism about the White House's move. He stated that the issue has been a topic of discussion under the name "hack back" for years and that Trump's notice merely directs law-enforcement agencies to create a list of actions the private sector could take to expedite responses to hacks.

Graham suggested that Trump's memo appears to be a directive to law-enforcement agencies to establish a list of potential measures that the private sector could take to accelerate responses to cyber attacks.

While the notice does not explicitly grant companies the right to seize assets like cryptocurrencies, Graham clarified that the memo is unclear on how recovered assets would be handled. He noted that any assets recovered would likely be directed towards the government. In a similar vein, a bill introduced last year in Congress aimed to authorize the President to issue "letters of marque and reprisal" to private companies, granting them additional options in combating cyber crimes against US residents.

Cyber-security software executive Bruce Payne likened this approach to bug bounty programs, stating that the US would gain more capability with less effort. However, the proposed legislation faced challenges as it did not advance beyond the committee level, raising concerns about potential concerns from other nations regarding sovereignty breaches.