A newly-signed presidential memorandum enlisting private sector companies in federal law enforcement hacking operations against criminal organizations could present a number of legal, practical and moral pitfalls, cyber experts told CyberScoop a day after the order was released.
While some have celebrated the memo as an overdue maneuver to more aggressively combat cybercriminals, others view it as risky at best and potentially destructive at worst. Supporters, critics and everyone in between also said that how it plays out could be decided in the 60-day timeframe the memo sets to establish the program.
But ultimately, “it’s a massive shift in the cyber policy community,” said Michael Garcia, a former top official at the Cybersecurity and Infrastructure Agency. “This is a philosophical shift.”
The Concerns
On the most critical end of the spectrum is security consultant Davi Ottenheimer, who has been a proponent of concepts like “hack back” or “active defense” that envision a bigger role for the private sector. But he was unsparing in his criticism of the Trump memo.
“It’s an embarrassment to America,” he told CyberScoop. “It’s like seeing somebody strapped onto a horse backwards, looking at the wrong end of a rifle.”
The Trump memo’s approach has been likened to the “letters of marque” concept used in early U.S. history, when it authorized sea privateers to attack and capture enemy ships and goods on behalf of the country. But Ottenheimer, founder of Ottenheimer GmbH, noted that the practice fell out of favor for good reason in the 1800s because of the violence it unleashed and how it contributed to mercenarism.
Additionally, the memo raises a number of targeting-related issues, he said. Ottenheimer is concerned about Trump’s intentions. The memo specifically pertains to the use of participating companies against transnational criminal organizations.
“Left-wing opposition, liberals, anti-fascists —they’re all criminals to him,” Ottenheimer said. “So to authorize attacking criminals under this means private organizations can go hack people that he designates as criminals.”
Under the memo, the program must establish legal and constitutional procedures for the prior approval of the targeting of U.S. citizens, as well as develop procedures to halt any unintentional targeting of U.S. people or systems.
However, the limitation on targeting criminals only creates a perverse incentive for attackers and a peculiar defense for anyone who’s attacked, Ottenheimer said.
He envisioned a scenario for a company participating in the program where “you’re hacking [a target], and they go, ‘Hey, we’re the state.’ And then [private companies] are like, ‘Oh, I can’t hack you anymore.’ Boom. They decided when you can and can’t hack.”
Furthermore, “you incentivize people to know as little as possible so [operations] can be authorized,” he said.
The memo raises ethical concerns for him as well: “You can’t attack somebody and then say it’s your fault that you didn’t notify them you didn’t want to be attacked.”
“There’s no notice for you being designated. There’s no prevention of you being designated. There’s no way for you to know you’re being designated,” Ottenheimer said. “That’s like a person sitting down next to you and smoking a cigarette and blowing smoke in your face and saying, ‘Hey, you got to say you don’t like cancer if you don’t want me to do this to you right now.’”
Garcia, now vice president of the cybersecurity practice at Monument Advocacy, said he supports some of the ideas of the memo, but worries about how it will be executed.
“It comes down to attribution, and if you make a risky bet on who we’re attributing [attacks] to, that’s where things can get dicey,” Garcia told CyberScoop.
There could be pressure to attribute faster, which could perhaps lead to lower certainty about who’s being targeted, and that in turn could lead to a private sector company accidentally attacking a foreign government, he said.
That raises legal questions: “It’s in the Constitution —the federal government has the ability to wage war. And there are laws by which private citizens can’t take up arms,” Garcia said.
He wanted the memo to include court oversight of the program, similar to what’s been required for private sector takedown operations. .
Garcia also isn’t sure whether there will be a big enough pool of companies willing to jump into offensive cyber operations.
“From the lawyer perspective, it’s, ‘Are you okay with engaging in this kind of legal risk? And who knows what protections the government will provide?’” he said. “I’d be very curious to see what the foreign governments’ reactions are — ‘We’re going to cut ties with any participating company that engages in this.’”
Errata Security CEO Robert Graham wrote that under the program, companies “are not willy-nilly hacking back,” given the federal supervision elements. “Though, I wonder if it doesn’t eventually morph into law enforcement saying ‘Stop bothering us, just do what you think is best.’’”
The Case For
The Trump administration and the memo’s supporters have touted it as a means to put the United States on stronger ground in cyberspace.
Amanda Naylor, the director of cyber policy at the National Security Council who worked on the memo, said on LinkedIn that it was designed “to bring the capabilities, speed, and innovation of the American private sector into the fight against transnational cybercrime and fraud.”
Former Trump White House cybersecurity official Joshua Steinman said he views the memo as a step toward “parity,” given how U.S. adversaries operate in cyberspace.
“The Chinese and the Russians do this at scale, and I guarantee you they have very few limiting tools when they do it,” said Steinman, now founder of the security firm Gavalnick. “It opens up an entire workforce that allows us to go out and achieve strategic objectives.”
The restrictions in the memo are important, he told CyberScoop.
“The most sensitive things are going to continue to be done by the uniformed and authorized civilian workforces, but there’s a lot of low-hanging fruit,” i.e., criminal organizations, Steinman said. He doesn’t have any fear of the program overstepping as a result.
“We operate like a Boy Scout in cyberspace,” he said. “It’s measured and reasoned.” He compared it to the Right to Try Act for medications.
He also said he expects to see a lot of interest in participating in the private sector.
Ari Redbord, global head of policy at TRM Labs, praised the memo too, calling it “a huge step toward empowering the private sector at a critical moment” that “has a real opportunity to be truly transformative.”
“Scammers are using AI to move with unprecedented speed and scale, stealing billions in life savings from average Americans and small businesses,” he said. “The private sector holds the data. The public sector holds the authorities. This [memo] puts them together.”
What’s Next
The coordination center charged with establishing the program under the memo has 60 days to complete its work. That process could determine a lot. Graham noted that the memo has a classified annex, too.
The memo as written is quiet about what becomes of any seized assets, Graham noted. Redbord raised the same topic as one of his questions about execution of the memo.
“What government direction and control looks like in the middle of a live operation,” he said in listing his questions. “How disruption turns into actual dollars back in victims’ pockets, and whether we can build a true victim compensation fund as part of this program. What happens when an operation touches a third country with its own laws and its own interests. And how success gets measured, in money recovered and networks dismantled.”
Will Barker, cybersecurity adviser at Huntress, said what’s next could be key.
“The 60-day implementing guidance is where the real substance lives,” he said in a written quote. “Minimum standards, operational procedures, the adjudicatory framework for target selection.”