Trump Administration Authorizes Private Firms to Conduct Cyberattacks

The Department of Justice and the Department of Homeland Security will manage the program, requiring participants to demonstrate high technical proficiency and facility security. Selected companies must maintain a bond or escrow of at least $1 million, which serves as a penalty for any breach of their contractual obligations. The directive limits these operations to criminal groups that lack direct ties to foreign governments, though critics warn that distinguishing between independent syndicates and state-backed actors remains difficult.

Jason Healey, a cyber conflict researcher at Columbia University, cautioned that individuals conducting these operations face substantial personal legal risks. The policy aims to harness the private sector’s capabilities, labeling businesses as underutilized assets in the fight against international cybercrime. Despite the government's push for innovation, the blurred lines between private action and state-sponsored activity threaten to ignite unforeseen geopolitical friction.