US to let private companies carry out cyberattacks on its behalf

President Donald Trump has signed a new national security presidential memorandum permitting private companies to carry out cyberattacks against so-called "transnational criminal organizations" on behalf of the federal government. The administration says the move will tap into the capability and innovation of the private sector to counter threats such as ransomware, sextortion, financial fraud and phishing.

Expanding legal exemptions

The Computer Fraud and Abuse Act, one of the main laws criminalizing hacking and unauthorized computer access, has traditionally applied equally to private companies and individuals. In 2022, the Department of Justice said it would stop prosecuting white-hat hackers conducting security research. The new memorandum significantly widens the range of cyber activity the DOJ could choose not to prosecute.

Many details still unresolved

The memorandum directs the Homeland Security Task Force to develop, within 60 days, standards for vetting participating companies and procedures for how the attacks will actually be carried out. Companies that join are also required to post a $1 million bond, which they would forfeit if they fail to follow government direction.

While the memorandum shields companies from US prosecution and offers a financial incentive to comply, it does not address what happens if companies or their employees face criminal charges abroad, in countries where the targeted computers are located. The order was signed following a series of cyberattacks on water facilities in Minnesota and Michigan that have since been linked to Iran. The US has itself charged foreign hackers on multiple occasions, raising the possibility that US-directed attacks could trigger similar legal responses from other countries.