US Government Launches Program Allowing Private Companies to Conduct Offensive Cyber Operations Against Foreign Criminal Groups

Introduction

The US government has unveiled a new program designed to combat cyber threats from foreign criminal groups. This program, aimed at vetted private companies, permits them to conduct offensive cyber operations against foreign cyber-enabled criminal organizations. This move represents a significant shift from the US stance that private companies can only defend against hackers, not attack them.

The Program Overview

The program, as outlined in TechCrunch, is a federal initiative under which private companies can conduct both surveillance and disruptive cyber operations against foreign cyber-enabled criminal organizations. The goal is to address threats such as ransomware, fraud, and other cybercrimes targeting Americans.

Requirements and Penalties

To participate in the program, private companies must first be vetted by the government. Once approved, they will need to obtain written approval from the Justice Department and the Department of Homeland Security for each operation. The companies will also be subject to federal supervision. In addition, participating companies may be required to put up at least $1 million in a bond or escrow account, which could be forfeited if they violate the rules.

The Scope of Operations

The operations authorized by the program can involve manipulating, disrupting, degrading, or destroying computer systems and data. Surveillance operations, which involve secretly accessing systems without the owner’s permission to gather intelligence, are also permitted. However, the program is intended to target foreign criminal groups rather than governments, and companies must stop and report any operation that accidentally targets a US person or a US-based system.

Guardrails and Future Developments

While the program is intended to provide significant powers, there are also guardrails in place. The precise rulebook for the program is not yet finalized, with officials given 60 days to establish the operating procedures. The program is also intended to target foreign criminal groups rather than governments, and companies must stop and report any operation that accidentally targets a US person or a US-based system.

Expert Analysis

Cybersecurity veteran Jake Williams, as reported by TechCrunch, described the program as 'half-baked,' warning that Americans involved could face legal trouble or accusations from foreign governments when traveling overseas. The program represents a significant departure from the US government’s traditional position that private companies can defend against hackers but shouldn’t launch attacks themselves.

Conclusion

The US government’s new program allows vetted private companies to conduct offensive cyber operations against foreign criminal groups. While the program provides significant powers, it also includes strict oversight and penalties. The program is intended to target foreign criminal groups rather than governments, and companies must stop and report any operation that accidentally targets a US person or a US-based system. The program’s precise rulebook is not yet finalized, and officials have 60 days to establish the operating procedures.

Read what readers said or add your take.