Trump gives private firms 'hacking license' to strike foreign criminal networks

President Donald Trump has signed a national security presidential memorandum authorizing vetted private companies to conduct offensive hacking operations against foreign criminal organizations.

The White House announced Wednesday that Trump signed the memorandum, titled "Expanding Capabilities to Counter Transnational Cybercrime," according to cybersecurity outlet CyberScoop and Britain's Guardian, among other outlets that reported the news Thursday.

Under the directive, a National Coordination Center under a Department of Homeland Security task force will be established to run programs aimed at disrupting overseas cybercriminal networks.

Companies participating in the program must contract with the Department of Justice or the Department of Homeland Security and pass rigorous vetting before carrying out designated operations — ranging from surveillance missions to "cyber operations" that involve manipulating and destroying adversary networks. Participating firms are required to maintain a deposit or escrow of at least $1 million.

The move comes against a backdrop of surging cybercrime losses: Americans lost more than $20.8 billion to cyber-enabled crime last year.

The national cybersecurity strategy announced in March had already signaled the government's intent to "unleash" the private sector and create incentives for its involvement. Sean Cairncross, the national cyber director, also hinted in March at allowing private-sector participation in offensive cyber operations.

Chris Wysopal, co-founder of cybersecurity firm Veracode, called the move "a pretty significant shift in US cyber policy," according to CyberScoop. Jason Kikta, a former US Cyber Command official, was more critical, calling it "a perpetual motion machine for generating billable threats."

How the policy will handle hacking groups with ties to foreign governments remains unclear. Department of State officials said earlier this year that many Chinese-linked organizations operating fraud complexes in Southeast Asia appear connected to Chinese government projects. The Justice Department has also named Cambodian and Myanmar government and military figures as linked to transnational criminal organizations in recent indictments.

Meanwhile, critical infrastructure in several US states was hacked this year, disrupting water treatment facility operations.