US government reportedly permits private firms to conduct offensive cyberattacks against foreign criminals

The policy change allows private cybersecurity firms to conduct offensive operations, including surveillance and disruption, against foreign criminal networks. This marks a departure from previous practices where such operations were conducted exclusively by government agencies. The shift aims to leverage private sector capabilities but introduces new oversight and compliance requirements for participating firms.

Private firms must demonstrate technical proficiency, operational track records, and secure facilities to qualify. They must also post a $1 million bond, forfeitable for non-compliance. These measures are intended to ensure accountability, but the operational risks remain high. Firms may struggle to accurately attribute attacks, as criminal groups often route traffic through compromised infrastructure, increasing the likelihood of unintended consequences.

The policy explicitly excludes targets affiliated with foreign governments, but distinguishing between state-aligned and independent criminal groups is notoriously difficult. Experts caution that misattribution could lead to legal liability for firms or escalate geopolitical tensions. Engineers involved in these operations may face personal legal risks, particularly when traveling abroad, as their actions could be classified as non-uniformed combatant activity.

The program reflects a broader trend of outsourcing offensive cyber capabilities, but its effectiveness remains unproven. Previous government-led operations avoided these risks by maintaining direct control. The reliance on private firms introduces variables in coordination, consistency, and accountability, which could undermine the policy’s stated goals of combating cybercrime without provoking unintended conflicts.