Nicolai Haugsted
Trump gives companies access to powers once largely reserved for the US government.
Donald Trump is expanding the American government’s approach to cybercrime by bringing private companies directly into operations against criminal groups operating abroad.
A national security memorandum signed by the president on Wednesday establishes a framework under which approved businesses could participate in offensive cyber operations targeting foreign organizations.
Rather than giving companies unrestricted authority to launch attacks independently, the policy places participating firms under federal supervision and limits their activities to targets and operations authorized by Washington.
Cyber operations capable of disrupting or damaging foreign computer systems have traditionally remained largely within the domain of government and intelligence agencies.
Trump’s memorandum opens part of that territory to private companies.
According to the White House, federal agencies have been instructed to “leverage the capability and innovation of the private sector to help conduct these cyber operations under the direction, control and authority of the US government”.
Companies would therefore operate as partners rather than independent cyber forces.
Federal authorities could approve “limited cyber operations at the direction of the US government”, with foreign-based criminal organizations among the intended targets.
According to The Guardian, Trump’s administration has identified ransomware operations, financial fraud and other internationally organized cybercrime as particular concerns.
Operations could disrupt or destroy systems
Responsibility for establishing the new program will fall to the Department of Homeland Security, working alongside the Department of Justice.
Participating companies would first have to pass a vetting process. Approved firms could subsequently carry out both “cyber surveillance operations” and more aggressive “cyber effects operations” against designated targets.
Scope for the latter category could be significant.
“Cyber effects includes the potential manipulation, disruption, denial, degradation or destruction of information systems, networks, physical or virtual infrastructure controlled by information systems, or information resident thereon,” the memorandum states.
Private companies could also enter agreements with other businesses and different levels of government to gather intelligence on foreign criminal organizations.
Collected information could then be used to propose potential operations against identified threats.
Trump administration had signaled the change
Washington’s decision follows earlier indications that the administration wanted businesses to play a substantially larger role in American cyber strategy.
A national cybersecurity policy published in March promised incentives designed to “unleash the private sector” against foreign adversaries.
Wednesday’s memorandum provides a clearer mechanism for putting that policy into practice.
Legal specialists have previously questioned how companies participating in offensive operations could navigate the risks associated with involvement in international cyber conflicts.
Federal supervision is consequently a central feature of the new framework, with private participants acting under government authority rather than selecting their own targets.
The policy arrives as governments confront increasingly sophisticated digital attacks and growing concern over the potential use of artificial intelligence by hackers.
Powerful AI systems have demonstrated an ability to identify and exploit weaknesses in outdated cybersecurity infrastructure, adding another dimension to existing concerns about ransomware and organized cybercrime.
American infrastructure has already faced significant attacks this year. Hackers targeted critical systems across several states, including water facilities where attacks resulted in operational disruptions.
