U.S. President Donald Trump (R) and Russian President Vladimir Putin arrive for a press conference at Joint Base Elmendorf-Richardson on August 15, 2025 in Anchorage, Alaska. <\/p>\n
Andrew Harnik\/Getty Images<\/p>\n
President Donald Trump\u2019s new plan to enlist private companies to help disrupt cybercriminals abroad may face a fundamental problem when it comes to Russia: distinguishing criminal hackers and state-backed operatives.<\/p>\n
Russian intelligence services have long tolerated, protected or intermittently recruited financially-motivated hackers without exercising full control over them. That dynamic gives Moscow easier access to hacking talent, and it complicates a major carveout in Trump\u2019s new directive that excludes groups part of or directed by a foreign government, experts and former U.S. officials say.<\/p>\n
\u201cThe line between government control, government-affiliated and government-acknowledged is certainly blurry in Russia,\u201d said Michael Daniel, president and CEO of the Cyber Threat Alliance and a former White House cybersecurity coordinator under President Barack Obama. \u201cDetermining the exact relationship between malicious actors and the Russian government has long been a challenge and is often impossible.\u201d<\/p>\n
A White House memorandum signed last week paves the way for vetted U.S. companies to conduct cyber surveillance and operations that manipulate, disrupt and destroy systems used by foreign criminal groups. Companies would work under contracts with the Justice Department and Department of Homeland Security, and every operation would require written approval.<\/p>\n
The memo says eligible targets cannot be \u201can institutional part of a foreign government\u201d or \u201cwholly operated under a foreign government\u2019s direction.\u201d It then instructs officials to assume a group is not part of, or wholly controlled by, a foreign government unless \u201cclear intelligence\u201d establishes that connection.<\/p>\n
Such intelligence collection from spy agencies like the National Security Agency and CIA can help firms determine targeting criteria, though it may not be enough for Russia\u2019s ever-evolving cyber landscape.<\/p>\n
\u201cRussia\u2019s cyber web is opaque and always shifting, blurring lines between government and cybercriminal, with no single rule for understanding each and every relationship,\u201d said Justin Sherman, CEO of Global Cyber Strategies, a Washington, D.C.-based research and advisory firm.<\/p>\n
Some of that ambiguity is intentional and allows the Kremlin to expand the pool of hackers it can covertly draw upon, Sherman said. It also reflects broader and pervasive corruption conditions inside Russia.<\/p>\n
U.S. companies may have insights about those groups but lack the broader intelligence available to the government. Federal agencies, meanwhile, can only share or declassify so much, he said. \u201cPrivate companies have critical insights in some ways and limited in others,\u201d Sherman said. With an incomplete picture, \u201cyou\u2019re bound to get it wrong some of the time.\u201d<\/p>\n
Simple indicators don\u2019t necessarily settle attribution questions, he added. Ties with the FSB \u2014 Russia\u2019s Federal Security Service that succeeded the Soviet Union\u2019s KGB \u2014 do not by themselves prove that a criminal group is state-directed, nor does a Russian intelligence service\u2019s use of tools developed by criminals establish continuous government control.<\/p>\n
\u201cSimple, bumper sticker ideas for deciding if a Russian cybercriminal is a state actor or not will often collapse in practice,\u201d said Sherman.<\/p>\n
Past cases illustrate how those relationships can work. In 2017, the DOJ charged two FSB officers with directing and protecting criminal hackers involved in the breach of Yahoo. Prosecutors said one of the hackers also conducted separate intrusions for personal profit. The Treasury Department has similarly said Maksim Yakubets, the alleged leader of the Evil Corp cybercrime organization, worked for the FSB and was tasked with projects on behalf of the Russian state while his organization carried out financially motivated attacks.<\/p>\n
\u201cThe Russians haven\u2019t been strangers to using private sector proxies to get what they want, as long as they\u2019re not attacking them,\u201d said Chris Painter, a former State Department cyber coordinator and White House cyber official. He questioned how a company could determine where a particular group falls along that continuum when the answer is often not immediately apparent, even for well-resourced governments.<\/p>\n
The new policy is the latest step in an offensive cyber posture the administration has been building for the last year. Trump\u2019s national cybersecurity strategy, released in March, called for \u201cunprecedented coordination\u201d between government and industry on offensive and defensive missions. It pledged to \u201cunleash the private sector\u201d by creating incentives for companies to identify and disrupt adversary networks.<\/p>\n