Private companies will be allowed to conduct cyberattacks on transnational criminal organizations on behalf of the US government, following a new national security presidential memorandum signed by President Donald Trump. The move is intended to leverage the capabilities of the private sector to respond to cyber threats such as ransomware attacks, financial fraud, and phishing. This decision marks a significant shift in the government's approach to cybersecurity, as it will enable private companies to engage in activities that were previously prohibited under the Computer Fraud and Abuse Act.
The memorandum directs the Homeland Security Task Force to develop standards for vetting companies that wish to participate in the program, as well as procedures for carrying out attacks. Companies that participate will be required to pay a $1 million bond, which will be forfeited if they fail to comply with the government's direction. While the memorandum offers protection from US prosecution for participating companies, it does not address the potential consequences of criminal charges in foreign countries where the targeted computers are located.
The decision comes in the wake of a series of cyberattacks on water facilities in Minnesota and Michigan, which have been linked to Iran. The US has previously charged foreign hackers with cybercrimes, and it is possible that US-directed attacks could be met with a similar response. The details of how the program will work are still unclear, but the Homeland Security Task Force is expected to provide more information within the next 60 days.
The Trump administration believes that the private sector can bring innovation and capability to the fight against cybercrime, and that this program will help to disrupt and deter malicious cyber activity. However, the lack of clarity on the potential consequences for companies and individual employees who participate in the program raises questions about the risks and challenges associated with this approach. As the program moves forward, it will be important to monitor its development and assess its effectiveness in combating cyber threats.
