President Donald Trump signed a presidential memorandum on August 12 establishing the first U.S. program that lets vetted private companies conduct offensive cyber operations, including attacks that destroy data and systems, against foreign cybercrime organizations. Participating firms must post at least $1 million in escrow, forfeited if they break the program's rules, and every operation requires written approval from officials of the Department of Justice and the Department of Homeland Security. Just a few months ago, the administration publicly ruled out this very policy.
In March, Thomas Lind, then a senior adviser at the Office of the National Cyber Director, told a conference the administration had no plans to authorize private offensive operations. "We're not interested in fighting pirates with pirates," Lind said. National Cyber Director Sean Cairncross said the same week that companies running offensive campaigns weren't what the administration meant when it asked industry for more help.
The memorandum authorizes two categories of activity: "Cyber Surveillance Operations," meaning unauthorized access to foreign systems to collect intelligence while staying undetected, and "Cyber Effects Operations," meaning the disruption or destruction of systems and the data on them. A National Coordination Center manages the program, implementation guidance is due within 60 days, and eligibility rules will admit both large firms and smaller companies suited to specialized tasks. Any company that unintentionally hits a U.S. person or a system on U.S. soil must halt operations and notify the government immediately.
A foreign group qualifies as a target under the memo unless "clear intelligence exists" establishing it's institutionally part of a foreign government or wholly operated under one's direction. Ransomware crews that operate with state tolerance but not formal state control, a description that fits much of the Russia-based ransomware ecosystem, stay well within the target scope. The DOJ and DHS directors can't approve operations likely to cause loss of life or rise to an armed attack under international law.
The memo stops short of prohibiting such operations, with approval authority for them sitting in a classified annex. Participating companies can also sign commercial deals with other private firms, and with state and local agencies, to receive threat data and propose operations based on it.
Jake Williams, vice president of research and development at cybersecurity firm Hunter Strategy, told TechCrunch that Americans involved in the operations "could easily be classified as non-uniformed combatants while traveling overseas." The memo follows suspected Iranian cyberattacks on water suppliers in 45 U.S. municipalities and a CISA alert on Iranian hackers targeting programmable logic controllers at water and energy companies, though state-directed hackers fall outside the program's own definition of a valid target.
Congress earmarked $1 billion for offensive cyber operations in last year's spending bill, and Google said in August last year it was preparing to take part in disruptive actions against cybercriminals.