New White House Program May Strip Providers of Legal Threat Sharing Protections
In a significant development concerning cybersecurity, a new White House initiative has come to the forefront, which allows private companies to actively engage in hacking foreign cybercriminals. This initiative, however, has raised concerns among analysts regarding its potential to jeopardize the legal protections these companies currently rely upon to defend their networks and safeguard their customers.
The initiative, signed into effect in August by U.S. President Donald Trump, authorizes designated U.S. firms to engage in surveillance and various operations aimed at combating foreign criminal groups—a move that could alter the landscape of cybersecurity in unforeseen ways. This warning was notably voiced during a session hosted by the Institute for Security and Technology, where former government officials and leaders in threat intelligence discussed the implications of this memorandum.
Leonard Bailey, an adjunct professor at Georgetown University Law Center, articulated the concern that the memorandum could sideline the very companies that are best equipped to confront and disrupt the infrastructures of criminal organizations. He emphasized that electronic communication service providers, which include internet service providers and cloud service companies, operate under existing laws that view them as private entities. If these providers share information or deploy defensive measures under existing frameworks, such as the Cybersecurity Information Sharing Act of 2015, their participation in the new program could complicate their legal standing, as they would be seen as operating as federal entities rather than independent private actors.
Under the current legal framework, many providers lean on exceptions within laws like the Stored Communications Act and the Wiretap Act to intercept and disclose information. However, Bailey cautioned that these exceptions could be lost if the companies act as government agents under the new program, complicating their operational capabilities in combating cyber threats. He stated, "Some of the operational authorities that private entities use right now to conduct cybersecurity activities might not be available if they’re acting under this national security presidential memorandum."
The memorandum directs the National Coordination Center to craft a program that would allow participating companies to target foreign transnational cybercriminal organizations under federal oversight. However, operations require written approval from co-executive directors of the Justice and Homeland Security Departments, who must ensure that any operations do not pose risks such as loss of life or escalation into armed conflict.
Alex Orleans, a leader in threat intelligence at Sublime Security, noted that while targeting adversary infrastructure is indeed crucial in tackling cybercrime, the program appears to miss the mark in its broader expectations. He remarked, "Infrastructure is the Achilles’ heel for actors. It’s the hardest thing for them to compartment." Orleans further expressed doubts about the industry’s perception of its own targeting abilities, suggesting that companies may be overestimating their capacity for effective attribution.
Moreover, the risks associated with this initiative extend beyond cybersecurity firms to major defense contractors. Orleans emphasized that prominent Russian criminal groups often maintain ties with Russian domestic intelligence agencies, meaning that private firms engaging in disruptive actions could provoke serious repercussions.
With nearly 170 countries possessing some form of cybercrime legislation regarding hacking, Bailey highlighted the very real risk of legal prosecution abroad for private actors acting under the auspices of the U.S. government. He stressed that private companies could inadvertently be in violation of foreign laws while attempting to target criminals. Furthermore, there are commercial considerations: companies associated with U.S. government operations may face challenges in global markets due to perceptions tied to being a government agent.
Jason Kichen, the chief information security officer at Fluidstack, warned of a disparity in the program’s impact on various businesses. While larger firms like CrowdStrike and Google may already be engaged in government contracts for such activities, smaller entities, like a hypothetical "Bob’s Computers LLC," might find themselves ill-prepared and unaware of the complexities involved.
Megan Stifel, COO of the Institute for Security and Technology and a former Justice Department attorney, pointed out the intricate interagency coordination required for the program to function effectively. She remarked, "It’s very easy to throw a roadblock up," alluding to the historical difficulty in maintaining effective partnership models among government agencies.
Adding another layer of complexity, the memorandum authorizes the Departments of Justice and Homeland Security to require participating companies to post a bond or escrow amounting to at least $1 million. Critics, including Bailey, have labeled this sum inadequate in the context of potential cyber incidents.
In light of the prospective implications this initiative may hold for cybersecurity, it raises critical questions about the balance between government action against cybercrime and the legal protections afforded to private companies. Scrutiny will likely continue as the operating procedures for the program are finalized by the impending deadline of October 11.