Worth a Try: The U.S. Will Authorize Some Companies for Cyber Counterattacks
The White House is wisely not just outsourcing to privateers but creating an entire institutional framework. The co-executive directors (policymakers from the departments of Justice and Homeland Security) will vet and contract with companies and approve and retain operational control of their activities. Companies will have to report their activities to the government and can be ejected from the program if they fail to live up to standards.
Handling such a novel and challenging program would be hard for any government, much less one so thoroughly DOGEd and short of quality staff. As Ron Deibert earlier argued, ‘the new policy would take place in the context of an administration that has systematically weakened oversight and compliance offices across the government.’ Three vitally important parts of government highlight the challenge: the Department of Justice is removing staff seen as enemies of the president; the Department of Homeland Security (DHS) is obsessed with border security; while DHS’s Cybersecurity and Infrastructure Security Agency has been drained of talent.
The US Congress must commit to reporting and oversight to ensure these authorized cyber companies – many of which will be staffed with veterans of the same organizations meant to oversee them – cannot capture their ostensible regulators.
Given these American limitations, other nations in the Five Eyes pact, such as Britain or Australia, may actually be better positioned to conduct these experiments in authorized private offensive cyber operations than the US is.
In addition, the White House must set out criteria to measure both success and failure. Without clear metrics, supporters of this policy can continually assert they have nearly won and just need to be a bit more aggressive, needing a bit longer leash. That playbook worked in neither Vietnam nor Afghanistan. Nor, so far, has it worked for the Pentagon’s plan for persistent offensive engagement by US Cyber Command.
So, sure, let’s allow the private sector to get into the counter-offensive game as well, but only with very specific criteria to know when it is working and when it is making things worse. The White House (and Congress) must be ready to cancel the program if it gets out of control or is not clearly succeeding.
Lastly, as Jake Williams and others have pointed out, anyone conducting these operations is doing so at substantial personal legal risk. The United States may not prosecute them, but that wouldn’t stop Russia or China issuing an Interpol Red Notice or an EU prosecutor issuing arrest warrants when some mission impinges on EU sovereignty. Still, as long as everyone has their eyes wide open to the risk, this is more of a personal, not policy, issue.
Relying on the offence is not a long-term plan.
Defenders cannot counterattack their way to a more secure cyberspace: there are too many adversaries pursuing too many easy pickings. But offence might meaningfully reduce depredations in the short term. Policymakers and defenders must use any respite to shift advantages from attackers to defenders, at scale.
In the meantime, a controlled, well-overseen plan to disrupt cybercriminals’ attacks is an experiment worth trying.
Jason Healey is a senior fellow at ASPI. He is a senior research scholar at Columbia University’s School for International and Public Affairs specializing in cyber risk and conflict, and is a part-time senior strategist at the National Risk Management Center at the US Cybersecurity and Infrastructure Security Agency. This article is published courtesy of the Australian Strategic Policy Institute (ASPI).
