In a first, US will allow some private firms to carry out cyberattacks

Key Points:

• The U.S. government, under a new Trump administration memorandum, will for the first time permit vetted private companies to conduct offensive cyber operations against international criminal gangs and hackers, including surveillance and disruptive attacks.
• This policy shift breaks from longstanding U.S. federal laws that prohibited private sector cyberattacks without court approval, aiming to leverage private sector innovation to combat threats like ransomware, financial scams, and sextortion targeting Americans.
• Participating companies must meet strict requirements, including a $1 million escrow deposit and government supervision, with operations requiring Justice Department and Homeland Security approval, while explicitly forbidding targeting Americans or U.S.-based systems.
• The program is in early stages, with guidance forthcoming, and faces potential legal challenges and criticism over risks such as diplomatic fallout and the danger to Americans working overseas who might be classified as combatants by foreign governments.
• The move comes amid escalating international cyber threats linked to geopolitical conflicts, including attacks on U.S. critical infrastructure attributed to Iranian-backed hackers, and concerns over autonomous AI-driven cyberattacks targeting global organizations.