White House Cyber Ops Order Clears Path for Private Firms to Target Foreign Cybercrime Groups

A new order from the White House seems to clear the way for US-based digital privateers to sail the digital seas and engage in cyber ops against enemies, but thus far few specifics are available and targets would be strictly limited to designated Transnational Criminal Organizations (TCOs).

Cyber ops order puts strict boundaries on foreign government entities

In a way, the new cyber ops order is a more limited form of what some US rivals are already doing. The former CISA director famously warned that China fields about 50 cyber agents for every one the US has, and to a great degree that is owed to looping in private companies into their espionage and hacking missions. The new US “privateers” would not have the same range of operation, instead strictly focusing on foreign crime syndicates; particularly, scam and fraud rings that predominately operate out of Southeast Asian nations.

Those are still worthwhile targets, doing billions of dollars of damage collectively each year in stolen money and disruption of business operations. They also essentially enslave a lot of their workforce, promising well-paying jobs to foreigners and then trapping them in a subsistence living with threats of violence when they arrive. But the cyber ops proposal has raised some serious questions about consequences for participating companies and their employees, even if it does steer them away from foreign government and infrastructure targets and promise rigid supervision and pre-approval of actions.

Can private cyber ops work in the US?

So these participating firms will not be roaming far and wide in pursuit of cyber criminals, instead limited to helping with pre-approved cyber ops against listed TCOs (which are generally very large cartels or entities that do cyber crime to fund terrorism). Full terms are still being ironed out but oversight will be provided by the National Coordination Center (NCC) along with the Department of Justice and the Department of Homeland Security.

There will also be initial screening of applicants for necessary technical proficiency, and each participating organization will have to put up a $1 million bond. And there does not seem to be an organization size requirement, with a note indicating small organizations with specialized skills will actually be encouraged to apply for relevant niche roles.

The big things that are off the table are “hacking back” and anything that might lead to an attack on a foreign government entity or critical infrastructure. However, there are serious questions about how realistic it will be to prevent that from happening and what the consequences for these companies will be when they do. Could a foreign government label employees as wanted criminals and attempt to seize them when they travel outside the US? And what liability consequences and civil liberties protections would be in place when one of these cyber ops ends up compromising a domestic citizen target?

NCC has been given 60 days to shore up details of the cyber ops program. Until then, it is very difficult to evaluate but certainly something that should give organizations pause due to the potential consequences of participation.