White House Authorizes Private Sector Cyberattacks on Criminals

The White House last week issued a presidential memorandum that permits vetted private companies to initiate cyberattacks against hacker groups, marking a significant shift in federal cyber policy. This new directive reverses previous government policy, which had prohibited companies from conducting such operations without explicit court approval. The memorandum states that "American businesses’ innovative capabilities have historically been underutilized in efforts to identify and disrupt criminal networks operating in cyberspace." It further articulates the policy of the United States to "use all instruments of national power, including the innovative capabilities of the private sector, to combat cybercrime." Over the next two months, the government is expected to detail the specific requirements and vetting processes that companies must meet to participate in these authorized cyber operations. However, the memorandum leaves several critical questions unanswered, particularly concerning the legal protections afforded to these private entities. A major concern is the potential for individuals involved in these operations to face arrest by foreign governments. The memo offers no clarity on how such situations would be handled or what recourse would be available. Cybersecurity expert Eric O’Neill, a former FBI operative and author, highlighted this ambiguity, stating, "Sending someone into this environment with ambiguous government backing and figuring out their status after they are arrested would be irresponsible." He further cautioned that "U.S. authorization does not magically erase another country’s laws," meaning a foreign government could still consider an intrusion into its infrastructure a crime, irrespective of Washington's authorization. Jud Dressler, head of the Risk Operations Center at cyber risk company Resilience, echoed these concerns, emphasizing that the memorandum grants private-sector firms no special legal rights. Dressler also pointed out that companies engaging in these operations could expose their employees to significant risks, noting, "There is no explicit legal entitlement to government assistance." The implications of this policy shift are far-reaching, potentially enabling a more aggressive stance against cybercriminals by leveraging private sector expertise, but also introducing complex legal and ethical challenges regarding jurisdiction, liability, and the safety of private operatives.