WASHINGTON — President Trump wants private companies to hack the hackers.
In a memo issued late Wednesday, the Trump administration announced a program that could authorize some U.S. businesses to pursue government-selected foreign cybercriminals.
In the past, that work has been performed by government agencies.
The presidential memorandum doesn't fully explain how it would allow a private business to take the lead on work traditionally performed by the U.S. government, like spying or disruptive cyber operations.
U.S. anti-hacking laws broadly bar people and businesses from hacking digital infrastructure, with some exceptions to allow law enforcement work. This memo does not change those laws, but it mandates any participating company be contracted with the federal government.
Nevertheless, the memo presents a dramatic departure from the way America's private sector currently behaves in cyberspace. If implemented, it would allow some private businesses to disrupt foreign organizations the government says are cybercriminals or gather intelligence on those groups.
"There's a range of potential targets … like organized crime … people doing money laundering or other criminal activity," said Joshua Steinman, who served as senior director for cyber policy on the National Security Council during President Trump's first term.
Since the Trump administration took power last year, two Republican congressmen put forward legislation that would call for cyber "privateers," a term that draws from 16th century naval warfare, to take the fight to foreign hackers. This memorandum does not give private businesses that ability, though it elicited online praise from proponents of the idea.
The nitty gritty
It's unclear what companies might want to take the government up on this opportunity.
Private corporations have long worked with the federal government to help disrupt cybercriminals, but largely as contractors fulfilling a support role, not digital saboteurs handed a target.
"There are going to be a lot of people out there who see this as an onramp to doing additional work for the United States government," said Steinman.
That could include smaller firms, venture capital backed startups, and companies looking to get in on potentially lucrative government contracts.
"I'm sure a lot of these companies will see this as a potential opportunity to … improve their visibility or directly command resources from the government," said Arthur Tellis, a former Department of Defense staffer and current fellow at the Institute for Progress.
Tellis said these private companies would likely be better at surveillance than actually disrupting criminal enterprises.
Participating companies would enter contracts with the Department of Justice or the Department of Homeland Security, undergo "rigorous vetting" and set aside $1 million the government can collect if a company doesn't meet its obligations.
These companies would then get permission to attempt to access the computer networks of foreign groups and take actions that "result in the manipulation, disruption, denial, degradation, or destruction of information systems," according to the memo.
Much of what that vetting would look like, and the process by which potential targets would be selected, isn't described in the memo. Nor are the types of disruptive attacks or the legal justification for them.
Stacy O'Mara, chief policy officer at the cybersecurity company Armadin, said the document has her in "wait and see" mode. She believes any company that does decide to sign up would have to answer a number of legal questions.
"There are all these other components that are still outstanding," O'Mara said. "Especially around the legal authorities and protections."
The memo gives DOJ and DHS two months to resolve some of these open questions.
Opposition from industry
Some in the cybersecurity industry think the memorandum takes the country's digital defenses in the wrong direction. Paul Rosenzweig is in that camp. He leads a consulting firm in Washington, D.C., and was deputy assistant homeland security secretary for policy under President George W. Bush.
"It's not an incomparably bad idea, but it's a bad idea," said Rosenzweig.
He also says the order doesn't address the number of practical and legal issues any private actor would have to deal with if they hacked a foreign organization.
"Anything that our new cyber-enabled private sector actors do overseas will assuredly be against the domestic law of a host of countries wherein they act," Rosenzweig said. "The internet is not bounded in by sovereign borders in the same way that physical space is."
The memo wouldn't allow private businesses to launch cyberattacks on other governments, but many foreign cybercriminals operate in a grey area between state-sponsored and not. Targeting the wrong group could end up inciting an international incident.
Chris Wysopal, a veteran cybersecurity professional and co-founder of the security firm Veracode, told NPR he's not interested in taking part in the kinds of operations laid out in the memo.
He's worried about potential liability. What if something goes wrong? What if an attack targets a U.S. company by mistake? What if a counterattack goes too far?
"You don't want to have collateral damage when your blast radius is too big at the data center you were trying to take down, and you took down a transportation company or hospital's servers," Wysopal said.
The risks of cyberattacks
Americans lose billions of dollars every year to cyberattacks.
Cybercriminals break into private businesses and public utilities alike, threatening to hold data hostage or leak it if they aren't paid. They steal personal information from victims and manipulate people into transferring them money.
"Ransomware and scams are getting worse and worse," said Wysopal. "I have a mother who sends me emails asking me, 'Is this real? Is this real?' And I just imagine that is happening everywhere."
Cyberattacks are also a national security threat. Just last month, Minnesota reported dozens of local water systems had been targeted in a coordinated attack, which American intelligence links to Iran.
Steinman, the former Trump official, said a faster paced private sector can help the country's offensive cyber capabilities, as long as it's done carefully.
"The point of this is to get started," he said, "And I trust that the people that are running it are going to be very measured in their initial efforts to try and build out this capability."
But others say even if the legal and technical issues in the president's memo are resolved, it still won't fix the growing threat of cybercrime — especially in the short term.
