Folks, I almost spilled my coffee reading this one. The Trump administration is now enlisting private companies to conduct cyberattacks on foreign cybercriminals, which is a major policy shift that experts say could come with legal risks for the companies. I mean, who wouldn’t want to get involved in a little cyber warfare, right? It’s not like it’s a complex issue with a lot of potential pitfalls. The move gives vetted companies a prominent role in hacking operations that have historically been the dominion of US law enforcement, spy, and military agencies. Because, you know, what could possibly go wrong with private companies hacking into foreign systems?
The program’s goal is to punish foreign criminal groups that cause Americans billions of dollars in annual losses. The program’s remit is foreign criminal groups, not governments. So, it’s all about going after the bad guys, but not the really bad guys, like nation-states. Companies can use cyber tools to surveil foreign criminals and disrupt their networks under the “control and oversight” of the new federal program, according to a memo issued by President Donald Trump. I’m sure the “control and oversight” part will be totally effective and not at all problematic.
“American businesses’ innovative capabilities have historically been underutilized in efforts to identify and disrupt criminal networks operating in cyberspace,” the memo says. Yeah, because what American businesses really need is to get involved in cyber warfare. I’m sure their shareholders will be thrilled. The US government is already doing a lot of hacking on foreign targets, so this new program is just a way to get more players in the game. The new program risks having too many cooks in the kitchen, some former officials said. You think?
“The real risk is that you end up with a bunch of cyber privateers running around without any clear coordination or direction at the federal level,” said Andrew Schoka, a former Army officer at US Cyber Command. Deconflicting in cyber operations “is already a major challenge for federal agencies, but now you’re adding in the complexity of private sector firms with a lot more capability and speed,” Schoka told CNN. Yeah, because that’s exactly what we need, more complexity and speed in our cyber operations.
The new program could free up US government resources, which is a good thing, since Chinese government-backed hackers outnumber FBI cyber personnel 50-to-1, according to former FBI director Christopher Wray. Having private sector help to counter cyber criminals allows the US to disrupt more groups and frees up agencies like FBI and Cyber Command to focus more on countering nation-states like China, said Cynthia Kaiser, a former senior FBI cyber official. But, you know, the devil is in the details, and companies will need more explicit information about liability protections, types of government oversight, and foreign criminal use of US infrastructure, among other concerns.
Chris “Weld Pond” Wysopal, co-founder of cybersecurity firm Veracode, said the new federal program would be a more organized way of dealing with the problem, but he also worried about the potential consequences of a government-sanctioned hacking operation carried out by a private firm that goes awry. Hacking a data center in a foreign country to target scammers could, for example, inadvertently affect a hospital, he said. Yeah, because that would be a great way to win friends and influence people.
Foreign governments may also see employees of companies participating in the new hacking program who travel abroad as legitimate targets for detention or questioning, Wysopal said. Officials from the departments of Justice and Homeland Security will oversee the new hacking group, which is reassuring, I guess. Any program activity “directed at a United States person” must undergo extra legal scrutiny, including from the Justice Department, the memo says. But Jason Kikta, a former Cyber Command official, said the new memo didn’t lay out a clear process for ensuring cyber operations uphold the civil liberties of American citizens.
In conclusion, this new program is a bold move, but it’s also a bit of a wild card. I mean, who knows what could happen when you get private companies involved in cyber warfare? It’s not like it’s a recipe for disaster or anything. But hey, at least it’s an interesting development, and I’m sure it will all work out just fine. After all, what could possibly go wrong with private companies hacking into foreign systems? Oh wait, I forgot, this is the US government we’re talking about, so it will probably all work out perfectly and not at all chaotic. 🙄
Armchair patriot. Believes in the free market, cold beer, and that there’s always a guy named George behind every CNN segment.
Former remote-throwing champion turned #1 couch commentator on liberal panic in the media. Born in Texas (or so his mug says), he earned a degree in Fake Newsology & Beer Philosophy from YouTube University.
