The program could allow vetted private US companies to access targeted systems without the owner’s authorization and, in more disruptive operations, damage or destroy systems or infrastructure.
The Trump administration is opening the door for vetted US companies to conduct cyber operations against foreign cybercriminal organizations under federal supervision, giving the private sector a more direct role in disrupting cyber-enabled crime.
A presidential memorandum issued on August 12 directs the National Coordination Center to create a program authorizing participating companies to conduct cyber surveillance and cyber effects operations against foreign groups engaged in cyber-enabled crime targeting US interests.
The memorandum says, “any resulting operational action will be exclusively conducted on behalf of and under the supervision of the Federal Government.”
Companies admitted to the program will have to contract with either the Department of
Justice or the Department of Homeland Security and undergo government vetting. The memorandum gives officials 60 days to establish operating procedures and requires written approval for every proposed operation before a participating company can act.
The program could extend well beyond conventional threat monitoring. Cyber surveillance operations involve accessing systems without the owner’s authorization or exceeding authorized access, while cyber effects operations can interfere with systems or infrastructure and may extend to their destruction.
The memorandum allows participating companies to receive threat information collected by private-sector organizations during normal business activities, which may then be used to propose cyber operations to the National Coordination Center.
The collateral damage problem
The arrangement amounts to a limited form of government-authorized private-sector “hack back,” although it differs substantially from companies independently pursuing attackers, said Pareekh Jain, CEO of Pareekh Consulting.
Government control may constrain what participating companies can do, but it does not eliminate the operational risks, Jain said. An incorrectly identified target could belong to an innocent organization or fall under another country’s jurisdiction, while disruptive action could also provoke retaliation against the security company carrying it out.
“Avoiding collateral damage is extremely hard,” he said. “Cybercriminals often don’t buy their own servers as they hide inside real company networks, hack smart home devices, and rent standard cloud servers using stolen credit cards.”
Jonathan Ong, senior analyst for managed security services at Omdia, said the accountability picture for participating companies also remains unclear.
“The commercial cyber company has neither immunity nor indemnity that we can see from the memorandum, and does not have the protection from nation-state capabilities that a government agency does,” Ong said.
As a safeguard, the memorandum says companies must stop an operation and immediately notify the National Coordination Center if they unintentionally target a US person or certain US-linked systems.
Such steps are useful, Jain said, but their effectiveness will depend on how accurately targets can be identified and on rules that have yet to be developed.
A new purpose for threat intelligence
For CISOs, the policy could change how threat intelligence gathered during normal business activities is ultimately used. Data provided by enterprises could feed proposals for government-approved cyber operations.
“Enterprise CISOs should be careful before feeding telemetry into these programs,” said Neil Shah, vice president for research at Counterpoint Research. “The threat intelligence is used to block and defend, but in the future, if it is used under this framework for monitoring, intelligence, and to actively disrupt and/or destroy, it would be detrimental.”
Shah said CISOs will also want assurance that information they share does not expose details of their own infrastructure, particularly where systems may already have been compromised by attackers. Data sharing could also raise privacy concerns if it involves deep tracking of customers, he said.
CISOs should also check whether existing contracts and privacy rules allow such information to be shared if it could later be used for an offensive operation, according to Jain.
Attribution adds another complication. Infrastructure associated with an attack may itself have been compromised, meaning an IP address or server may not identify the attacker behind an intrusion, Jain said.
Will cyber firms participate?
The commercial case for participation is another open question.
“I don’t see the financial incentive for a mega-cap cyber company to undertake the risks,” Ong said. Access to adversary infrastructure could offer intelligence value, but Ong said that information may not necessarily translate into material that can be used for detection engineering or commercial threat feeds.