Trump administration opens door to private-sector cyber offensives

The Trump administration is opening the door for vetted US companies to conduct cyber operations against foreign cybercriminal organizations under federal supervision, giving the private sector a more direct role in disrupting cyber-enabled crime.

A presidential although it differs substantially from companies independently pursuing attackers, said , senior analyst for managed security services at Omdia, said the accountability picture for participating companies also remains unclear.

“The commercial cyber company has neither immunity nor indemnity that we can see from the memorandum, and does not have the protection from nation-state capabilities that a government agency does,” Ong said.

As a safeguard, the memorandum says companies must stop an operation and immediately notify the National Coordination Center if they unintentionally target a US person or certain US-linked systems.

Such steps are useful, Jain said, but their effectiveness will depend on how accurately targets can be identified and on rules that have yet to be developed.

A new purpose for threat intelligence

For CISOs, the policy could change how threat intelligence gathered during normal business activities is ultimately used. Data provided by enterprises could feed proposals for government-approved cyber operations.

“Enterprise CISOs should be careful before feeding telemetry into these programs,” said , according to Jain.

Attribution adds another complication. Infrastructure associated with an attack may itself have been compromised, meaning an IP address or server may not identify the attacker behind an intrusion, Jain said.

Will cyber firms participate?

The commercial case for participation is another open question.

“I don’t see the financial incentive for a mega-cap cyber company to undertake the risks,” Ong said. Access to adversary infrastructure could offer intelligence value, but Ong said that information may not necessarily translate into material that can be used for detection engineering or commercial threat feeds.