The Trump administration is encouraging American companies to conduct their own cyberattacks against criminal hackers, a move that White House officials say will help address digital scourges like ransomware but that some former officials and security experts warn could lead to chaos.
Under a national security memorandum that President Trump signed late Wednesday, select companies would work with the Justice and Homeland Security Departments to strike foreign cybercriminal groups with hacks under certain conditions. The attacks would allow both surveillance of the criminal networks and specific types of hacking operations that could lead to disruption, manipulation or destruction of information systems and networks, including virtual and physical infrastructure.
The move is a sharp pivot from decades of cybersecurity policy across Republican and Democratic administrations that generally prioritized improving corporate defenses and confined offensive cyberoperations to the U.S. military and intelligence agencies. It adds detail to a shift that Trump officials had teased in general terms for months.
The concept of giving the private sector a more direct role in offensive cyberactions has been around for years. But it has never before been publicly endorsed by a presidential administration, in part because of concerns that doing so could provoke more cyberconflict, raise novel questions of liability and international legal exposure for U.S. firms, and have unforeseen — and potentially escalatory — consequences. The new memorandum does not directly address many of those concerns, though it states that the policy is meant to tap into the “ingenuity of the private sector” to stem the ever rising costs of cyberattacks.
Rather than permit a free-for-all on the digital battlefield, however, the conduct that U.S. companies can engage in is intended to be relatively circumscribed. Participating companies must first be vetted to be included in the program, sign a contract with the government that includes $1 million fines for violations, and receive written approval from officials at the Justice and Homeland Security Departments before proceeding with an attack. The policy will not authorize attacks that are likely to lead to loss of life, serious injury or “rise to the level of use of force or armed attack under international law,” though former officials and experts said precisely calibrating offensive cyberoperations is sometimes as much an art as a science.
The White House did not respond to questions about the memorandum. The Trump administration did not brief reporters on the order ahead of its release late Wednesday.
Amanda Naylor, director of cyberpolicy at the National Security Council, which helped draft the memo along with the Office of the National Cyber Director, said in a LinkedIn post that the memo would “give the United States new tools to protect Americans from cybercrime and fraud.”
But many former officials and some security executives expressed worry that the new approach could be difficult to enact and risked complicating the already unpredictable world of modern cyberwarfare. Among other issues, it appeared that the approved companies could potentially take actions that exceed the authorities granted to the government’s own security agencies, a former senior U.S. intelligence official said.
Mr. Trump’s executive action contains a classified annex laying out a process to deconflict private-sector hacking with the federal government’s own operations. The memo also specifies that attacks will be limited to transnational criminal organizations that are considered separate from a foreign government “unless clear intelligence exists establishing such connection.”
Nick Carr, the threat intelligence lead at Microsoft and a former cybersecurity official, said in a social media post that his biggest concern was “just how difficult attribution in criminal operations is, and how few organizations can repeatably do it right,” including government agencies. He added, however, that the order could improve those efforts.
Still, it is often murky whether a criminal hacking group, such as a Russian-speaking gang of cyberthieves, has ties to a foreign power or at times does work for a spy agency on the side. Michael Garcia, who served as the associate chief of policy at the Cybersecurity and Infrastructure Security Agency until departing in June, said that while attribution had improved over the years, it still was not perfect and that “obfuscation is still a hell of a tactic.”
Some former officials said the order sought to address a growing and unsustainable problem that was probably only going to become worse in the short term with artificial intelligence.
“The current pace of cyberoperations is unsustainable for just the military,” said Mieke Eoyang, a former Pentagon official who oversaw military cyberweapon use during the Biden administration.
Ms. Eoyang, now a visiting professor at Carnegie Mellon University, said the memo’s success would hinge on the classified procedures for vetting firms and approving targets. She added that the existing process for approving military cyberoperations, developed during the first Trump administration, was “onerous, but it took into consideration collateral consequences and deconfliction.”
To some extent, the new order would align the United States more with some of its chief cyberantagonists, including China and Russia, where spy agencies have long relied on contract hackers working in the private sector to further their national security missions, in part to afford the state plausible deniability. U.S. defense technology companies also support the National Security Agency and U.S. Cyber Command, but that relationship usually involves supplying hacking tools, cyberintelligence and tradecraft to the U.S. intelligence community and military, rather than engaging directly in cyberoperations.
Dakota Cary, an expert on China’s hacking ecosystem, said that historically Beijing had copied various cybersecurity policies from the United States, but that the new Trump policy was a reversal of that arrangement.
“In many ways, China’s hacking prowess now stems from the fact that they copied our education system,” said Mr. Cary, an adviser at the U.S. cybersecurity company SentinelOne. “Now it seems the U.S. is interested in copying China’s system for deputizing private-sector hackers.”
Given all its complexities, it was not clear what companies might participate in the program, which some lawyers said appeared to contain substantial risk.
“This approach from the government presents novel questions for publicly traded companies in the sector: Even if they engage in ‘hack back’ activities under U.S. government cover or direction, how will they manage the increased operational risk to their business and customers, and how and when will they disclose it?” said Vanessa Le, a partner at Latham & Watkins who advises companies on geopolitical risk.
