Trump administration enlists private companies to fight cyberattacks

In a first for the United States, the White House is looking to build an army of private hackers to combat cyberattacks.

Outlined in a new presidential memoranda issued Aug. 12, the Trump administration will begin contracting out efforts to curb the actions of transnational criminal organizations (or TCOs) to American businesses.

“American businesses’ innovative capabilities have historically been underutilized in efforts to identify and disrupt criminal networks operating in cyberspace,” the order reads. “It is the policy of the United States to use all instruments of national power, including the innovative capabilities of the private sector, to combat cybercrime.”

The new program will be overseen by Trump’s National Coordination Center (NCC). The center, in coordination with the Department of Justice and Department of Homeland Security, will vet and authorize businesses to conduct cyber surveillance and effects operations, the White House explains.

These “private sector entities” will the enter contractual agreements with the federal government, granting them access to relevant information from federal, state, local, tribal, and territorial agencies to pinpoint threats and propose offensive efforts. The businesses would be on the lookout for TCO networks involved in distributing ransomware, launching phishing attacks, and enabling financial fraud or sextortion.

Prior to the new memoranda, the U.S. government barred private companies from conducting cyber offenses without court approval. Private hacking operations will still need to abide by the Computer Fraud and Abuse Act which forbids retaliatory hacking, also known as “hacking back,” the White House made clear. Federal agencies will also need to sign off on operations before they can proceed. The NCC has 60 days to establish procedures for the new program.

The notice is an expansion of a March 6 Executive Order titled “Combating Cybercrime, Fraud, and Predatory Schemes Against American Citizens,” which directed federal agencies and resources to more aggressively intervene in escalating cybercrime attacks against Americans. In the months since, private companies have announced their own cyber offense programs, including a new “disruption unit” out of Google.

Conservative leaders have previously floated reauthorizing “letters of marque” related to cybercriminals. Under old maritime law, letters of marque allowed private mercenaries to attack and capture enemy ships on behalf of the government. Critics of private cyber offensive proposals have worried that such offensives could have rippling legal and diplomatic ramifications.