What's Happening?
The Trump Administration has announced a new "Hacking Back" program, which permits U.S. companies to engage in cyber surveillance and cyber effects operations against foreign Cyber-Enabled Transnational Criminal Organizations (CE-TCOs) under federal government
oversight. This program, managed by the National Coordination Center (NCC), requires participating companies to enter contractual agreements with the Department of Justice or the Department of Homeland Security. These agreements ensure rigorous vetting and adherence to strict operational procedures. The program also mandates operational deconfliction across various federal agencies, including federal law enforcement, the Department of State, the Department of the Treasury, the Department of War, the Department of Justice, and the United States Intelligence Community. The NCC will establish consensus operating procedures within 60 days to ensure complete federal government oversight and control, including minimum standards for participating companies and reporting requirements to advance understanding of CE-TCO activities.
Why It's Important?
This program represents a significant shift in U.S. cybersecurity policy, potentially blurring the lines between government and private sector roles in national security. By authorizing private companies to conduct offensive cyber operations, it aims to enhance the nation's ability to counter cyber threats from CE-TCOs. However, it also raises complex legal questions, particularly concerning the Computer Fraud and Abuse Act (CFAA). The program's reliance on private entities for cyber operations could lead to debates over accountability, liability, and the scope of authorized actions. The potential for civil lawsuits against companies participating in the program, even with government approval, highlights the legal ambiguities. The program's success hinges on its ability to navigate these legal challenges while effectively deterring and disrupting cybercriminal activities that impact the American people and economy.
What's Next?
Within 60 days of the memorandum's date, the Program Executive Directors, in coordination with the Homeland Security Council, are tasked with establishing consensus operating procedures for the program. These procedures will detail minimum standards for participating companies, ensuring technical proficiency, proven performance, facility security, and personnel vetting. The Department of Justice will also review any program activity that targets a U.S. person or implicates U.S. constitutional, federal, or international law obligations, requiring necessary authorization. Companies considering participation will need to carefully evaluate the legal implications, particularly regarding potential civil liability under the CFAA, even with executive branch blessing. The program's implementation will likely involve ongoing legal scrutiny and potential adjustments as its operational framework is tested.
Beyond the Headlines
The "Hacking Back" program delves into profound ethical and legal considerations regarding the delegation of state-level cyber warfare capabilities to private entities. It challenges traditional notions of sovereignty and the use of force in the digital realm, as private companies, rather than solely government agencies, will be conducting operations that could have international implications. The program's design, which seeks to provide a legal framework for actions that might otherwise violate the CFAA, could set a precedent for future public-private partnerships in national security. It also raises questions about the transparency and oversight of such operations, especially given the classified annexes mentioned in the memorandum. The long-term impact could include a redefinition of cyber warfare and the role of non-state actors in defending national interests, potentially leading to new international norms and legal interpretations concerning cyber activities.
