WASHINGTON — President Trump wants private companies to hack the hackers.
In a memo issued late Wednesday, the Trump administration announced a program that could authorize some U.S. businesses to pursue government-selected foreign cybercriminals.
In the past, that work has been performed by government agencies.
The presidential memorandum doesn't fully explain how it would allow a private business to take the lead on work traditionally performed by the U.S. government, like spying or disruptive cyber operations.
U.S. anti-hacking laws broadly bar people and businesses from hacking digital infrastructure, with some exceptions to allow law enforcement work. This memo does not change those laws, but it mandates any participating company be contracted with the federal government.
Nevertheless, the memo presents a dramatic departure from the way America's private sector currently behaves in cyberspace. If implemented, it would allow some private businesses to disrupt foreign organizations the government says are cybercriminals or gather intelligence on those groups.
"There's a range of potential targets … like organized crime … people doing money laundering or other criminal activity," said Joshua Steinman, who served as senior director for cyber policy on the National Security Council during President Trump's first term.
Since the Trump administration took power last year, two Republican congressmen put forward legislation that would call for cyber "privateers," a term that draws from 16th century naval warfare, to take the fight to foreign hackers. This memorandum does not give private businesses that ability, though it elicited online praise from proponents of the idea.
It's unclear what companies might want to take the government up on this opportunity.
Private corporations have long worked with the federal government to help disrupt cybercriminals, but largely as contractors fulfilling a support role, not digital saboteurs handed a target.
"There are going to be a lot of people out there who see this as an onramp to doing additional work for the United States government," said Steinman.
That could include smaller firms, venture capital backed startups, and companies looking to get in on potentially lucrative government contracts.
"I'm sure a lot of these companies will see this as a potential opportunity to … improve their visibility or directly command resources from the government," said Arthur Tellis, a former Department of Defense staffer and current fellow at the Institute for Progress.
Tellis said these private companies would likely be better at surveillance than actually disrupting criminal enterprises.
Participating companies would enter contracts with the Department of Justice or the Department of Homeland Security, undergo "rigorous vetting" and set aside $1 million the government can collect if a company doesn't meet its obligations.