The United States is preparing to give selected private companies a role in government-authorised cyber operations against foreign criminal organisations, marking a major shift in how governments may use the private sector to fight cybercrime.
A presidential memorandum released on August 13 outlined plans to allow vetted US companies to participate in cyber operations directed and supervised by the federal government.
The programme is aimed at combating transnational criminal organisations involved in cyber-enabled crime, including ransomware, fraud and other attacks targeting American individuals and businesses.
For years, the basic principle surrounding private cybersecurity companies has been relatively straightforward.
Companies could defend themselves and their customers from cyberattacks.
They could investigate attackers, collect intelligence and help victims recover from breaches.
But launching disruptive operations against another organisation’s computer systems has traditionally been a responsibility reserved for governments.
The new policy could change that.
Under the proposed framework, private companies that meet government requirements may be able to support operations involving foreign criminal groups under federal direction and oversight.
The White House said participating companies would remain subject to strict conditions and that operations would require government approval.
The policy is still in its early stages, and further guidance is expected to define exactly how the programme will operate.
The move reflects a growing frustration with the scale of international cybercrime.
Many major attacks originate from criminal groups operating outside the countries where their victims are located.
Those groups can target companies and individuals across borders while benefiting from the difficulty of international investigations.
Governments have increasingly relied on sanctions, criminal indictments and law-enforcement operations to disrupt such networks.
But cybercriminal groups can often rebuild infrastructure and continue operating under new names.
Allowing private companies to contribute more directly could give governments access to additional technical expertise and speed.
The cybersecurity industry has some of the world’s most specialised knowledge of malicious infrastructure, threat actors and digital vulnerabilities.
Private companies often identify attacks and track criminal groups before governments publicly respond.
Supporters of the new approach may therefore argue that governments should make greater use of those capabilities.
However, the policy also raises difficult questions.
Cyber operations can have consequences beyond their intended target.
A server used by a criminal group may also be connected to legitimate services.
An operation designed to disrupt one system could potentially affect others.
There are also concerns about how foreign governments might respond if private American companies become involved in government-authorised operations against networks located abroad.
The White House memorandum attempts to address some of those issues by placing participating companies under federal supervision.
The government will maintain oversight and control over approved operations, while companies will need to meet technical, security and personnel requirements before participating.
The change could nevertheless become one of the most significant policy developments in modern cybersecurity.
The line between government cyber operations and private cybersecurity has traditionally been clear.
Private companies protect.
Governments attack when necessary.
The new programme could make that distinction less straightforward.
The policy also arrives as artificial intelligence is changing the cybersecurity landscape.
AI systems are making it easier to analyse large amounts of security information, identify vulnerabilities and automate parts of cyber defence.
The same technology can also help attackers.
Governments may increasingly need access to the innovation and expertise of private technology companies if they are to keep up with rapidly changing threats.
For now, the programme remains a developing policy rather than a fully operational system.
But its direction is clear.
The United States believes the private sector could play a more active role in combating cybercrime than it has in the past.
If the approach proves successful, other governments may eventually consider similar partnerships.
That could create a new era in cybersecurity, one where the private companies defending digital systems are also more directly involved in the operations designed to disrupt the people attacking them.
