The U.S. government has advanced plans to enlist private companies in offensive cyber operations against foreign criminal hackers, though critical issues, including financial support and accountability, remain unsettled. The initiative, first revealed in August, seeks to authorize vetted American firms to gather intelligence and disrupt the infrastructure used by transnational cybercriminals. Yet no decisions have been made about how to compensate companies for their work or assign blame if their actions inadvertently harm third parties.
Funding represents one of the most significant obstacles. Government officials are considering whether reimbursements could be tied to mission outcomes, but real-world constraints complicate this approach. For instance, cryptocurrency seized during operations may need to be returned to victims, leaving little revenue to offset costs. A former government official emphasized that even a presidential directive would not secure the necessary budget, leaving open questions about who will bear the financial burden.
Legal and operational risks further complicate the program. If a mission strays from approved parameters or mistakenly targets the wrong system, participating firms could face liability. Criminals often mask their activities by routing traffic through networks belonging to unwitting businesses, making disruptions risky. Delays may also arise from coordination with the FBI and foreign partners, some of whom may refuse to assist. The former official warned that mission reviewers must weigh law enforcement needs against intelligence objectives, as aggressive actions could disrupt active investigations.
Identifying legitimate targets adds another layer of difficulty. The program explicitly excludes groups with direct ties to foreign governments, but distinguishing between state-backed actors and criminal affiliates, especially in cases like Russia, where intelligence services operate alongside cybercriminals, proves challenging. This uncertainty could force program managers to make high-stakes approval decisions with incomplete information.
Participating companies may also become victims themselves. Criminal organizations could retaliate against firms involved in offensive operations, exposing employees to physical threats. The government has not yet outlined safeguards for businesses or their personnel, leaving potential participants exposed.
Despite these challenges, industry executives express enthusiasm for the opportunity. Snehal Antani, CEO of Horizon3.ai, said/FCW that the initiative could impose costs on adversaries by creating a new form of deterrence, but stressed that unresolved issues, particularly liability, authorities, and international coordination, must be resolved before the program can move forward. Firms see potential in developing specialized cyber tools for government contracts, though operational and legal uncertainties persist.
