Will Trump's cyber-security plan allow private companies to 'hack back'?

US President Donald Trump has announced plans to broaden the fight against cybercrime by allowing private-sector computer security companies to take action against attackers. In a recent notice, Trump highlighted the innovation and technological prowess of the US technology sector, urging it to contribute more effectively to combating cyber threats.

The White House aims to leverage the capabilities of vetted US companies, working under federal guidance and oversight, to counter transnational cybercrime, fraud, and other schemes targeting American citizens.

The concept of "hack back," or retaliatory hacking, has been debated within the cybersecurity community for the past 15 years. Robert Graham, CEO of Atlanta-based cybersecurity firm Errata Security, expressed skepticism about Trump's announcement, stating that it merely directs law-enforcement agencies to explore options for private-sector involvement in responding to cyberattacks more swiftly. Graham pointed out that the notice does not imply companies can seize assets or benefit financially from successful hackings.

Last year, a proposed bill in Congress sought to authorize the President to grant "letters of marque and reprisal" to private companies, granting them more authority to combat cybercrimes against US residents. Bruce Payne, from the cybersecurity software maker, compared this to bug bounty programs, suggesting that the US could enhance its capabilities with minimal investment.

However, the bill ultimately failed to advance beyond committee level due to concerns about sovereignty breaches. Graham emphasized that Trump's notice does not transform companies into cyber-security privateers, as companies do not retain any benefits or profits from successful hackings.