Trump Administration Proposes New Role for Private Sector in Cybersecurity

WASHINGTON — The Trump administration has unveiled a new initiative that encourages private companies to combat cybercriminals. A memorandum issued recently suggests selected U.S. companies could target foreign hackers. Historically, such operations have been conducted by government agencies.

The memorandum lacks specifics on allowing private firms to take over tasks like espionage or cyber disruption usually handled by the government. Existing U.S. laws prohibit hacking into digital infrastructures, except for law enforcement. This memo doesn’t change those laws but requires any participating company to contract with the federal government.

This marks a significant shift in how private companies could operate in cyberspace. If implemented, some businesses might engage directly with foreign organizations identified as cybercriminals, disrupting or gathering intelligence on them.

There’s a range of potential targets … like organized crime …people engaging in money laundering or other criminal activities,

explained Joshua Steinman, former senior director for cyber policy on the National Security Council.

The Impact on U.S. Businesses

The memorandum doesn’t yet specify which companies might express interest. Traditionally, corporations have supported government efforts against cyber threats mostly in a backup capacity rather than leading attacks.

Steinman highlighted that many might see this as a path to increased engagement with government contracts. Opportunities may attract smaller firms, startups backed by venture capital, and companies aiming for lucrative deals.

I’m sure a lot of these companies will see this as a potential opportunity to … improve their visibility or directly command resources from the government,

stated Arthur Tellis, a fellow at the Institute for Progress.

Selected firms would need to enter contracts with the Department of Justice or the Department of Homeland Security. This involves rigorous vetting and setting aside $1 million against unmet obligations. This would grant them access to foreign networks for potential manipulation and disruption. However, the memo doesn’t fully explain the vetting process, target selection, or justify the legality of proposed actions.

There are all these other components that are still outstanding…especially around the legal authorities and protections,

said Stacy O’Mara, chief policy officer at Armadin.

DOJ and DHS have been given two months to address these open issues.

Industry Opposition and Concerns

Some in cybersecurity view the memorandum as a misdirected strategy. Paul Rosenzweig, leading a consulting firm in Washington, D.C., and former deputy assistant secretary for policy under President George W. Bush, shared objections.

It’s not an incomparably bad idea, but it’s a bad idea,

he stated, citing numerous practical and legal challenges for private actors hacking foreign entities.

The complexity of internet operations across borders makes any private sector cyber-initiative questionable. Actions against groups perceived as mainly criminal but partially state-sponsored could trigger international disputes.

Chris Wysopal of Veracode expressed concerns over liability and cautioned against unintended outcomes. He noted potential issues like misdirected attacks that could affect U.S. companies or excessive retaliation.

You don’t want to have collateral damage when your blast radius is too big,

he emphasized.

The Cybercrime Threat

Cyberattacks cause billions of dollars in annual losses in the U.S. Public utilities and private businesses face risks of data being held hostage. Cybercriminals exploit victims for personal information and money.

Ransomware and scams are escalating, noted Wysopal. He described the practical implications and increasing challenges faced by individuals daily.

Cyberattacks also pose national security risks. A recent attack on Minnesota’s water systems, linked to foreign actors, underscored such threats.

Steinman affirmed the private sector’s potential to bolster offensive capabilities, but advised caution in development.

The point of this is to get started,

he said, expressing trust in the measured efforts of those implementing it.

Despite this, others argue that merely offensive strategies cannot resolve cybercrime in the face of ever-evolving threats.

I don’t think you can sort of offense your way to security,

Wysopal concluded.