Will Trump's cyber-security plan allow private companies to 'hack back'?

US President Donald Trump has announced plans to expand the fight against cyber crime by enabling private-sector computer security companies to take action against hackers, according to a notice issued on Wednesday evening. The President stated that the US private technology sector is highly innovative and technologically advanced, and should be actively involved in combating the surge in cyber attacks against the country.

The White House hopes that partnering with vetted US companies, subject to federal direction and oversight, will enhance the nation's ability to counter transnational criminal organizations and combat cyber crime, fraud, and other predatory schemes targeting American citizens. The concept is not new, as the term "hack back" has been discussed in the cybersecurity community for the past 15 years.

Robert Graham, CEO of Atlanta-based cybersecurity company Errata Security, expressed skepticism about the President's notice. Graham pointed out that the White House had avoided using the controversial term "hack back" in the notice, hoping it wouldn't draw attention to the issue. Graham believes the notice is merely directing law-enforcement agencies to establish a list of things they might allow the private sector to do, aiming to speed up response times to any hack.

The companies are not given the authority to seize Bitcoin on hackers' computers for themselves, according to Graham's interpretation of the memo.

In February, a bill was introduced in Congress to authorize the President to issue "letters of marque and reprisal" to private companies, empowering them to take more action against cyber crimes targeting US residents. Cyber-security software maker Bruce Payne compared this proposed legislation to "bug bounty" programs, which make it easier to identify software issues.

Payne suggested that the US would gain more capability with less effort. However, the proposed bill did not advance beyond the committee level and faced concerns about potential breaches of international sovereignty.

While parts of the President's notice remained unclear, Graham did not believe it would transform firms into cyber-security privateers. According to Graham, unlike traditional privateering, the current arrangement does not allow the private sector to keep a portion of the stolen assets, such as Bitcoin, for themselves.