U.S. government reportedly authorizes vetted private firms to conduct destructive cyberattacks on foreign cybercrime groups

The U.S. government has authorized a new program allowing private companies to conduct offensive cyber operations against foreign cybercriminal organizations. This marks a significant departure from previous policy, which explicitly ruled out such private-sector involvement. The program permits two types of operations: intelligence-gathering through unauthorized access and disruptive or destructive actions against systems and data. Companies must meet strict eligibility criteria and obtain approval for each operation, ensuring government oversight remains central to the process.

Participation in the program carries substantial financial and operational risks. Firms must deposit at least $1 million in escrow, which is forfeited if they violate program rules. Any unintended impact on U.S. persons or systems requires immediate cessation of operations and government notification. The program’s structure suggests a preference for specialized firms, as both large and smaller companies can qualify. However, the requirement for written approval from DOJ and DHS officials may slow response times, potentially limiting the program’s effectiveness against fast-moving threats.

The policy targets foreign cybercrime groups that operate independently of foreign governments, such as ransomware crews tolerated by states like Russia. State-directed hackers are explicitly excluded, though the memo leaves room for classified exceptions. This distinction may prove difficult to enforce in practice, as many cybercriminal groups operate in gray areas with varying degrees of state involvement. The program’s focus on non-state actors aligns with recent U.S. concerns, such as Iranian cyberattacks on water suppliers, but risks misclassification or unintended escalation.

Legal and geopolitical implications loom large for participating firms. Individuals involved in these operations could be classified as non-uniformed combatants if traveling abroad, exposing them to legal jeopardy. The program also raises questions about accountability, as private companies may lack the diplomatic protections afforded to government actors. While the policy aims to disrupt cybercriminal ecosystems, its success hinges on precise targeting and adherence to international norms, which may be challenging to maintain in offensive operations.