US reportedly permits vetted private firms to conduct offensive cyber operations against foreign threats

The US government is breaking with decades of policy by permitting private companies to engage in offensive cyber operations. Previously, federal law prohibited private entities from conducting cyberattacks, limiting them to defensive measures. This change allows vetted firms to perform surveillance and disruptive attacks on international criminal groups, such as ransomware operators or state-backed hackers. The shift is framed as a response to growing cyber threats, but it introduces new operational and legal complexities for participating companies.

Adopting this policy comes with significant costs and constraints. Firms must deposit $1 million in escrow, which is forfeited if they violate program rules. Operations require approval from the Justice Department and Homeland Security, and all activities must be government-supervised. The policy also mandates that companies report imminent threats to critical infrastructure, adding a layer of compliance. Smaller firms may struggle with these financial and regulatory burdens, despite the memorandum’s suggestion that they could be better suited for specialized tasks.

The policy’s limitations are notable. It explicitly prohibits targeting Americans or US-based systems, and operations must be approved by multiple federal agencies. However, the potential for diplomatic fallout remains high. Foreign governments could retaliate by accusing US-based cybersecurity professionals of acting as non-uniformed combatants, exposing them to legal risks abroad. Critics argue the policy is underdeveloped, with concerns about abuse or unintended consequences, such as escalating cyber conflicts. The lack of clarity on target selection and the absence of public details about participating firms further amplify these risks.

The policy’s rollout is still in its early stages, with guidance for participating companies expected within two months. Legal challenges are likely, given the contentious nature of private entities conducting offensive cyber operations. The memorandum does not address whether any firms are already involved, leaving questions about the program’s immediate impact. For engineers, this means navigating a new landscape where offensive capabilities are no longer the sole domain of government agencies, but also a potential responsibility for private sector security teams.