Private firms authorized for ‘hack-back’ cyberattacks against foreign crime

In a move that shatters previous public assurances, the administration signed a memorandum on August 12 establishing the first official U.S. program allowing vetted private companies to conduct offensive cyber operations against foreign cybercrime organizations. This landmark policy opens a door previously considered firmly closed, permitting private firms to engage in attacks aimed at destroying data and systems across international lines.

The authorization is not without significant guardrails. Participating companies must post a substantial $1 million in escrow—funds that are forfeited if they violate the program’s rules. Furthermore, every operation requires explicit written approval from officials within both the Department of Justice and the Department of Homeland Security, ensuring a layer of governmental oversight.

Before this authorization, there had been public skepticism regarding such activities. Just months earlier, officials had publicly stated that the administration had no plans to authorize private offensive operations. This shift, moving from outright denial to actionable policy, signals a profound reevaluation of how the U.S. addresses transnational cyber threats.

The new framework delineates two primary categories of activity: Cyber Surveillance Operations, which involve unauthorized access to foreign systems for intelligence gathering while remaining undetected, and Cyber Effects Operations, focusing on the disruption or destruction of systems and their associated data. A National Coordination Center is established to manage this ambitious effort.

Determining what qualifies as a target is a complex legal puzzle. The program outlines that a foreign group qualifies for targeting unless “clear intelligence exists” proving it is institutionally part of a foreign government or acts under its direction. This carefully drawn line allows the framework to encompass sophisticated actors, such as ransomware crews operating with state tolerance but lacking formal state control.

The memo also facilitates collaboration outside of direct attacks. Participating companies are permitted to enter into commercial deals with other private firms and state and local agencies to exchange threat data and propose retaliatory actions based on that intelligence.

The implications for the cyber world are vast. Experts suggest that American citizens involved in these operations could potentially be classified as non-uniformed combatants while operating overseas, underscoring the blurring lines between private enterprise and national security conflict. This development comes as Congress had previously earmarked $1 billion for offensive cyber operations, fueling the expectation that industry players were ready to move from pure defense to proactive offense.