Should the private sector be able to hack foreign cybercriminals?

Like Batman telling Robin to get to the Batmobile, the US government has called on the private sector to act as its sidekick in the fight against foreign cybercriminals.

According to an Aug. 12 memorandum signed by President Donald Trump, the National Coordination Center (NCC) is slated to stand up a program that will enable private companies to conduct “cyber surveillance operations and cyber effect operations against foreign cyber-enabled Transnational Criminal Organizations.”

The program will be overseen by co-executive directors from the Department of Justice (DOJ) and Department of Homeland Security (DHS). Participants will undergo “rigorous vetting” and enter a contractual agreement with the federal government, putting aside at least $1 million that can be forfeited if that contract is violated.

“American businesses’ innovative capabilities have historically been underutilized in efforts to identify and disrupt criminal networks operating in cyberspace,” the memo stated. “By partnering with vetted United States companies subject to the direction and oversight of the Federal Government, we will enhance our ability to counter TCO threats and combat transnational cybercrime, fraud, and other predatory schemes against American citizens.”

Lots of incentive. There are several reasons why private companies may be interested in participating in this new program, according to experts speaking to IT Brew.

Gary Barlet, public sector CTO at Illumio, said the initiative would give private companies the ability to “protect themselves and go after the people that are attacking them.”

“I think that companies are going to be a little more open to it because they can more aggressively defend themselves through the offense instead of just sitting back, always on the defense,” Barlet said.

Companies may also want to take part in the program for the publicity. “There’s certainly some PR benefits to it from a company perspective of being able to say, ‘Look what we did for the greater good,’” Barlet said.

Upsides. The new program would offer the federal government several benefits, as well. Barlet said the program is a good way for the government to leverage the breadth of talent and resources within the private sector and expand its offensive capabilities without paying a hefty price.

“From the government’s perspective, it’s really opening the aperture of what they have available,” Barlet said. “More tools in the toolbox.”

Stephen Boyer, founder and chief innovation officer at Bitsight, added that the cyber program can have a monumental impact on global cybercrime if successful.

“If you were to disrupt, and I don’t know if you can fully eliminate, but I would say degrade, some of these criminal groups, that will ripple through the planet,” Boyer said. “That has an opportunity to have really a global impact for good when you think about being able to reduce some of this criminality.”

Downsides. But some cybersecurity experts still have some concerns. Barlet, for example, said other nation states may deem participating companies as adversaries and begin to target them.

“Now the question becomes: Isn’t that already happening? Aren’t these companies already dealing with countries like Russia, China, Iran, North Korea?” Barlet said. “Those countries are actively targeting our companies anyway. So, how much of a downside is that? How much of a risk is that?”

Adam Marrè, CISO at Arctic Wolf, raised concerns around unintended consequences of offensive operations: “This could happen if you misattribute the attack and end up attacking the wrong infrastructure or the wrong target. It could also happen where, in conducting an offensive operation against infrastructure, you unintentionally harm people that are also on that infrastructure.”

Operations from participant companies will be subjected to an evaluation process that will assess possible unintended consequences. “That brings up another question, which is unclear from the memo and unclear from case law, which would be, who’s liable for that?” Marrè added. (The White House did not comment on either of these concerns.)

Greenlight? Despite its flaws, cybersecurity professionals IT Brew spoke with were largely in favor of the program.

“I definitely think that we should consider all options when addressing cybersecurity,” Marrè said. “I don’t think any one thing we do is going to be the magic bullet that is going to stop all cybercrime. I think there is a potential here for some benefit.”