In a first, US will allow some private firms to carry out cyberattacks

The U.S. government has announced a historic policy shift that will permit certain vetted private companies to engage in offensive cyber operations against international criminal groups and hackers. This decision, outlined in a newly released presidential memorandum, marks the first time the federal government has authorized private entities to conduct such actions. The White House confirmed the policy change on Wednesday, signaling a departure from longstanding restrictions that prohibited private companies from launching or operating cyberattacks without court authorization. Under the new directive, private firms participating in the program will be permitted to perform surveillance activities, including the deployment of spyware to gather intelligence, as well as execute disruptive measures designed to destroy or impair the systems of cybercriminals. These operations will focus on combating threats such as ransomware attacks, financial fraud, and sextortion schemes targeting American citizens. The policy aims to leverage the innovative capabilities of the private sector to enhance national security and counter cybercrime more effectively than ever before. This change represents a major departure from existing U.S. federal computer hacking laws, which have traditionally barred both individuals and corporations from engaging in unauthorized cyberattacks. Until now, the government's stance was clear: private entities could defend against incoming cyber threats but were not permitted to initiate or manage offensive operations. The new memorandum explicitly states that participating companies must adhere to strict guidelines and obtain approvals from officials within the Justice Department and Homeland Security before any action can proceed. The government plans to release detailed guidance within the next two months, outlining the criteria for eligibility and operational protocols. The memo indicates that companies of all sizes, ranging from large enterprises to smaller firms, may qualify for participation, with the latter potentially offering advantages in executing niche or specialized missions. To ensure compliance, each selected firm will be required to deposit $1 million in escrow, which will be forfeited if the government determines the company violated its obligations. Additionally, the policy mandates that any operation must not target U.S. citizens or domestic systems, further reinforcing safeguards against misuse. Companies that join the program will also be obligated to alert the government immediately upon detecting an imminent cyber threat directed at critical infrastructure, such as power grids or water utilities. This requirement underscores the administration’s intent to integrate private-sector expertise with governmental oversight to safeguard essential services. Despite the potential benefits, the policy faces immediate concerns from legal experts and cybersecurity professionals. Some argue that allowing private firms to conduct cyberattacks could lead to unintended consequences, including diplomatic tensions with foreign governments. There is also the risk that American employees working for these firms could be targeted by foreign authorities, similar to how U.S. prosecutors have pursued charges against foreign state-sponsored hackers. One industry veteran warned that participants could be perceived as non-uniformed combatants abroad, increasing their vulnerability to legal action or detention. As the government prepares to implement this unprecedented initiative, the full implications remain unclear. While the policy opens new avenues for combating cybercrime, it also introduces complex legal and ethical considerations that will require careful navigation. The coming weeks will be crucial in determining how this policy unfolds and whether it can achieve its intended goals without exacerbating existing challenges.