US moves to staff leaders for industry-partnered offensive cyber program

The U.S. has begun the process of selecting managers to oversee a new program enlisting private companies in operations against foreign cybercriminals, according to a former official and two other people with knowledge of the discussions.

The effort marks an early step toward implementing the initiative unveiled in August. But significant questions remain about how to pay participating firms and who would bear responsibility if their operations cause unintended harm, the former official and one of the people said.

All three sources were granted anonymity to share details of sensitive government discussions. It is unclear who is under consideration for the management roles or whether the government intends to fill them with existing federal officials.

The program allows vetted U.S. companies to gather intelligence on and disrupt systems used by foreign criminal hacker groups. Firms would operate under Justice Department or Department of Homeland Security contracts, with written approval for each mission. 

The developments mark a key step toward putting that policy into practice. But the conversations described by the sources highlight how much remains to be settled before companies can undertake the work.

The former official said the government is still working out how to fund the effort and compensate companies. Issuing a presidential memorandum does not itself provide money to carry out its instructions, the former official noted. 

“Who’s paying for this to be done, and what’s the financial incentive for any of these offensive cyber companies to actually do this?” the former official said.

Officials crafting the framework are exploring whether companies could be paid based on the success of their operations, but how those payments would work remains unresolved, the former official added. For example, stolen cryptocurrency recovered during an operation may need to be returned to victims, limiting what could be used to pay the companies that helped recover it.

One of the people familiar said companies also need clarity about their exposure if they strike the wrong target, exceed an approved mission or damage systems belonging to someone other than the criminals they are pursuing.

Cybercriminals can route their activity through compromised routers and other equipment belonging to innocent businesses, the person said. Disrupting that infrastructure could require coordination with the FBI and authorities in other countries, including places unwilling to cooperate with U.S. operations.

The U.S. for years has conducted cyber operations, gathered intelligence on foreign hackers and used court orders to dismantle criminal networks, often with technical assistance from private companies. Those activities draw on different legal frameworks, including bedrock Title 10 authorities that underpin military operations and spying. 

Firms also regularly help the government investigate and disrupt cyber threats.

CrowdStrike recently provided intelligence for an FBI operation targeting “laptop farms” that allowed North Korean operatives to pose as American remote workers. The White House argues that making greater use of industry’s capabilities under the new directive will help the government pursue those groups faster and on a greater scale.

The former official said managers reviewing proposed missions would have to navigate overlapping law enforcement and intelligence interests. In a hypothetical case, a mission intended to disrupt criminals could interfere with another spy agency’s investigation or access to a network.

Identifying eligible targets presents another challenge. The memo excludes groups that are directly tied to a foreign government, but instructs officials to assume otherwise unless clear intelligence establishes that connection.

As Nextgov/FCW previously reported, that distinction can be difficult to make in Russia, where intelligence services have tolerated, protected or recruited criminal hackers without maintaining full control over their activities. The former official said that ambiguity would place considerable pressure on the managers approving missions. 

Participating firms could also become targets themselves. The government would need to consider how to protect companies and their employees from retaliation, including physical threats from criminal organizations, one of the people familiar said.

The initiative has drawn significant attention from industry leaders that have zeroed in on military and intelligence agency demands for exquisite hacking tools and similar innovations that could give the U.S. a leg up in cyberspace.

“It is potentially a transformative approach that imposes cost on the adversary, creating a new form of deterrence, but it’s critical that liability, authorities, and international coordination be sorted out,” Snehal Antani, the CEO of Horizon3.ai, told Nextgov/FCW when asked about the program.

The Trump administration has spent much of the last year defining how private companies would fit into its push for more aggressive cyber operations. Its March cybersecurity strategy called for closer collaboration with industry to disrupt enemy hackers. 

But officials’ public remarks on the role companies would have in the efforts have considerably shifted. National Cyber Director Sean Cairncross said shortly after the strategy’s release that he was “not talking about private sector, industry or companies engaged in a cyber offensive campaign.” 

Some executives, nevertheless, expected agencies to eventually hire companies to carry out offensive operations.