The Private Sector’s Cyber Warfare Debut: A Risky Experiment in Covert Ops

The Trump administration has departed from long-standing federal computer hacking laws by allowing private companies to participate in government-led cyber operations. This policy shift raises more questions than answers about the efficacy and safety of this new approach.

On the surface, the White House appears to be seeking innovative solutions to combat increasingly sophisticated international cyber threats, including ransomware attacks and financial scams targeting Americans. The newly published presidential memorandum highlights the benefits of tapping into “innovative capabilities of the private sector” in this effort. However, critics argue that allowing private companies to engage in government-led hacking operations could have far-reaching consequences.

The policy change will permit participating firms to conduct surveillance, including the use of spyware, as well as make disruptive attacks aimed at destroying criminals’ data or systems. The memorandum requires private companies to deposit $1 million in escrow, which will be forfeited if the government finds out a company isn’t complying with its rules on how to conduct these operations. This safeguard seems woefully inadequate against potential abuses.

The program’s success will depend largely on the guidelines issued by the government within the next two months. These guidelines will determine which companies are eligible and what standards they must meet before being allowed into the program. Smaller private companies may be better suited for specialized operations, but this raises concerns about their preparedness to handle the complex and often clandestine nature of cyber warfare.

Critics argue that this policy could put Americans who work for private cybersecurity firms at risk of being indicted or taken into custody by foreign governments. This is a valid concern, given the administration’s lack of transparency on how specific targets will be chosen for these operations. As Jake Williams, an industry veteran and vice president of research and development at Hunter Strategy, pointed out, “Americans participating in these operations could easily be classified as non-uniformed combatants while traveling overseas.”

The policy also raises questions about the potential diplomatic fallout from allowing private companies to engage in government-led hacking operations. What if a foreign government complains that they were attacked by a U.S. company? The consequences of such an incident would be far-reaching and potentially disastrous.

In recent months, the United States has been facing a number of international cyber threats, including attacks on water infrastructure reportedly attributed to Iranian government-backed hackers. This policy change comes at a time when the country is grappling with a spate of autonomous AI-driven cyberattacks targeting companies and organizations worldwide.

While the Trump administration’s cyber memorandum may be seen as a necessary step in addressing these threats, it is far from clear whether this approach will yield the desired results. Critics argue that this policy is “half-baked” and lacks sufficient safeguards to prevent potential abuses.

The U.S. government must proceed with caution and transparency in implementing this program, weighing the potential benefits against the risks of catastrophic consequences.