The US will let private security firms hack overseas cybercriminals for the first time

The United States is set to permit private security firms to engage in offensive cyber operations against overseas cybercriminals for the first time, according to a new White House initiative. Traditionally, US private companies have been restricted to defending their own networks, but this new program will allow approved firms to surveil, disrupt, and even destroy overseas cybercriminal infrastructure while adhering to federal authority.

President Donald Trump signed the National Security Presidential Memorandum on Wednesday, marking the first authorization of private companies to conduct offensive cyber operations. The targets of these operations will be foreign cyber-enabled transnational criminal organizations that target US individuals, businesses, or government entities.

The White House emphasizes that the program will focus on combating ransomware, phishing, financial fraud, sextortion, and impersonation scams.

The Homeland Security Task Force's National Coordination Center will oversee the program, with joint executive directors from the Department of Justice and Department of Homeland Security. Companies participating in the program must contract with one of these departments and pass rigorous vetting procedures covering technical expertise, operational experience, facility security, and personnel.

Rules for the program are expected to be finalized within 60 days and must accommodate both large corporations and smaller specialized firms.

Authorized companies will have the authority to conduct covert cyber surveillance, including accessing systems without the owner's consent. They may also engage in more aggressive cyber effects operations, such as manipulating, disrupting, denying, degrading, or destroying systems, networks, infrastructure, and data. However, every operation requires written approval and must remain under federal supervision.

Program directors cannot authorize actions that could result in death or serious injury or constitute a use of force or armed attack under international law.

While the program aims to protect Americans from foreign-based organized criminal groups exploiting them in cyberspace, there are potential risks involved. Criminals often use compromised systems belonging to innocent parties, which could lead to collateral damage. Determining whether a cybercriminal group is connected to a foreign government can also be challenging, as the memo assumes independence unless clear intelligence proves otherwise.

Legal experts warn that staff participating in the program could face prosecution in foreign jurisdictions. There are also concerns about escalation, unintended consequences, and inadequate interagency coordination.