Trump Memo Lets Private Firms Conduct Cyberattacks on Criminals

President Trump signed a national security presidential memorandum on Wednesday authorizing private companies to carry out offensive cyber operations against foreign criminal organizations, under government direction.

The White House said the policy is meant to "leverage the capability and innovation of the private sector to help conduct these cyber operations under the direction, control and authority of the US government." The move extends a role traditionally reserved for government agencies to vetted private firms, though the memo stops short of giving companies unrestricted hacking authority. Instead, it authorizes "limited cyber operations at the direction of the US government."

The White House fact sheet cited ransomware attacks, financial fraud and other crimes carried out by what the memo calls "transnational criminal organizations," or TCOs. The move follows growing concern over cyberattacks amid increasingly powerful artificial intelligence tools capable of breaching outdated security systems, as well as attacks earlier this year on critical infrastructure in several states that disrupted water facilities.

The administration had previously signaled this direction. A national cybersecurity policy released in March said the government would create incentives to "unleash the private sector" against foreign adversaries, a plan that has drawn questions from legal experts about the risks companies could face by becoming enmeshed in international digital conflicts.

The memo sets up a framework encouraging companies to form agreements with other private entities and with federal, state, local, tribal and territorial agencies to gather threat intelligence on TCOs and propose cyber operations against them. It directs the Department of Homeland Security, through its homeland security task force's national coordination center, to build a program to "conduct specific cyber operations that disrupt foreign TCOs," overseen jointly by DHS and the Justice Department.

Once vetted, participating companies would conduct "cyber surveillance operations" and "cyber effects operations" against designated targets. The memo defines cyber effects as including "the potential manipulation, disruption, denial, degradation or destruction" of information systems, networks or infrastructure controlled by those systems. Participating firms must maintain a bond or escrow of at least $1 million.

The concept of enlisting private companies in cyber operations against criminal targets is not new and has previously drawn controversy over risks of escalation, unintended consequences and coordination problems between agencies. DHS and the White House did not immediately respond to requests for further details about the program.