Trump's Private Sector Hacking Memo: A Bold Strategy or a Dangerous Precedent?
A newly-signed presidential memorandum enlisting private sector companies in federal law enforcement hacking operations against criminal organizations has sparked a heated debate among cyber experts. While some have celebrated the memo as an overdue maneuver to more aggressively combat cybercriminals, others view it as risky at best and potentially destructive at worst.
Concerns and Criticisms
Security consultant Davi Ottenheimer has been a proponent of concepts like 'hack back' or 'active defense' that envision a bigger role for the private sector. However, he was unsparing in his criticism of the Trump memo, calling it 'an embarrassment to America' and likening it to the 'letters of marque' concept used in early U.S. history, which authorized sea privateers to attack and capture enemy ships and goods on behalf of the country.
Otenheimer noted that the practice fell out of favor in the 1800s due to the violence it unleashed and its contribution to mercenarism. He also raised concerns about the memo's approach, which he believes could lead to private organizations hacking people designated as criminals by the government, without proper oversight or accountability.
Targeting-Related Issues
The memo raises a number of targeting-related issues, according to Ottenheimer. He is concerned about the limitation on targeting criminals only, which creates a perverse incentive for attackers and a peculiar defense for anyone who's attacked. He envisioned a scenario where a company participating in the program could hack a target, only to be told to stop because the target is a state entity.
Otenheimer also raised ethical concerns, stating that 'you can't attack somebody and then say it's your fault that you didn't notify them you didn't want to be attacked.' He emphasized that there is no notice for being designated a target, no prevention of being designated, and no way to know you're being designated.
Support and Counterpoints
Michael Garcia, a former top official at the Cybersecurity and Infrastructure Agency, supports some of the ideas in the memo but worries about how it will be executed. He noted that attribution is a critical factor, and if the government makes a risky bet on who is behind an attack, it could lead to lower certainty about who's being targeted, potentially resulting in a private sector company accidentally attacking a foreign government.
Garcia also expressed concerns about the lack of court oversight of the program, similar to what's been required for private sector takedown operations. He wondered whether there will be a big enough pool of companies willing to jump into offensive cyber operations, given the potential legal risks involved.
The Case For the Memo
The Trump administration and the memo's supporters have touted it as a means to put the United States on stronger ground in cyberspace. Amanda Naylor, the director of cyber policy at the National Security Council, stated that the memo was designed to 'bring the capabilities, speed, and innovation of the American private sector into the fight against transnational cybercrime and fraud.'
Former Trump White House cybersecurity official Joshua Steinman views the memo as a step toward 'parity,' given how U.S. adversaries operate in cyberspace. He believes that the restrictions in the memo are important and that the program will not overstep its bounds.
What's Next
The coordination center charged with establishing the program under the memo has 60 days to complete its work. The process could determine a lot, including the minimum standards, operational procedures, and adjudicatory framework for target selection. Experts have raised questions about the execution of the memo, including what government direction and control will look like in the middle of a live operation and how disruption will turn into actual dollars back in victims' pockets.
Source: CyberScoop