The U.S. government has begun choosing managers for a new program that would hire private companies to carry out operations against foreign cybercriminals, Nextgov/FCW reported Thursday, citing a former official and two other people familiar with the discussions. The step moves a long-debated idea, enlisting industry in offensive cyber work, closer to practice while questions of payment and legal liability for participating firms remain open.

What Happened

According to Nextgov/FCW, it is unclear who is being considered for the roles or whether existing federal officials will fill them. The managers would review proposed missions, which the former official described as difficult because law enforcement and intelligence interests overlap. One disruption, for example, could undercut another agency's investigation or its access to a network.

The program comes from a presidential memorandum signed Aug. 12, "Expanding Capabilities to Combat Transnational Cyber-Enabled Crime." It directs the National Coordination Center of the Homeland Security Task Force to run operations against foreign transnational criminal organizations that commit cyber-enabled crime against Americans, led by two co-executive directors from the Justice Department and the Department of Homeland Security. The White House fact sheet said private companies would act under U.S. government "direction, control, and authority."

RelatedIran Security Chief Threatens Cables, Data Centers and AI Sites if Fighting Resumes

The memorandum covers two kinds of activity: surveillance operations to gather intelligence on criminal groups and "effects" operations to disrupt their systems. Vetted U.S. companies would sign contracts with the Justice Department or DHS, and every operation needs written approval from the executive directors. The agencies may require a bond or escrow of at least $1 million, forfeitable if a company breaks the rules. The co-directors were given 60 days to set operating procedures, and no operation may be approved without them. The memorandum also bars approving operations likely to cause loss of life, serious injury or an action amounting to use of force under international law.

Why It Matters

For security vendors and their boards, the program could mean a new line of government work with risks that ordinary contracts do not cover. Nextgov/FCW reported that firms want clarity on their exposure if they hit the wrong target, go beyond an approved mission or damage systems owned by others. Criminals often route attacks through hijacked routers and equipment belonging to innocent businesses, so a disruption could touch third parties. The memorandum itself contains no liability or indemnification provisions and says it creates no enforceable rights against the United States.

Money is also unsettled. The memorandum makes implementation subject to available appropriations, and officials are exploring paying companies based on operational success, Nextgov/FCW reported. Cryptocurrency recovered in an operation may have to go back to victims, limiting what could fund payments. Participating firms and their employees could also face retaliation, including physical threats from criminal groups.

Snehal Antani, chief executive of security firm Horizon3.ai, told Nextgov/FCW the model is "potentially a transformative approach that imposes cost on the adversary," but said liability, authorities and international coordination must be resolved first.

Context

The memorandum excludes groups that are an institutional part of a foreign government or wholly run at its direction, but it tells officials to assume a group is not state-tied unless clear intelligence shows otherwise. Nextgov/FCW noted that the line is hard to draw in Russia, where intelligence services have tolerated, protected or recruited criminal hackers.

The approach marks a shift in tone. Nextgov/FCW reported that National Cyber Director Sean Cairncross said in March he was "not talking about" companies running offensive cyber campaigns, even as that month's national cyber strategy called for closer work with industry against hackers.

What to Watch

Watch for the naming of the program's co-executive directors, the release or description of its operating procedures, a payment model and any legal safe harbor for participating firms. The memorandum requires a first status report to the Homeland Security Advisor and National Cyber Director within 180 days of signing.