White House OKs private firms for supervised cyber ops

A presidential memorandum issued Wednesday creates a program that authorizes vetted U.S. private companies to perform federally supervised cyber surveillance and cyber effects operations against foreign transnational criminal organizations. The program places participating firms under direct federal control for intelligence collection and, in some cases, disruption of criminal cyber infrastructure.

The National Coordination Center (NCC) will manage the program. Two co-executive directors, designated by the attorney general and the secretary of homeland security, must approve operations in writing before firms may act. Participating companies must pass a vetting process and sign formal contracts with the Department of Justice or the Department of Homeland Security. Contracts may require a bond or escrow of at least $1 million, forfeitable if a company fails to meet operational requirements.

Authorized activity is divided into cyber surveillance operations, which permit covert access to systems to gather intelligence, and cyber effects operations, which allow actions intended to disrupt, degrade, or destroy adversary information systems and infrastructure. Proposed operations will undergo multi-agency deconfliction that includes law enforcement, the State Department, the Treasury Department, the Department of Defense, the Justice Department and the Intelligence Community.

The memorandum limits targets to foreign, non-state criminal groups. Foreign entities will be treated as independent of foreign governments unless intelligence shows government control. The directive requires firms to stop operations and notify federal authorities immediately if they discover an accidental intrusion into a U.S. person or a domestic system.

The program bars operations that would produce “critical outcomes,” defined to include actions likely to cause loss of life, serious injury, or a use of force or armed attack under international law. The restriction is intended to keep lethal authority within federal agencies.

Participating firms may enter commercial agreements with other private entities to receive threat intelligence and may partner with federal, state and local agencies to identify specific foreign threats. The memorandum sets compliance, reporting and oversight standards companies must meet before receiving authorization. The White House presented the initiative as a way to use private-sector capabilities under government control to respond to sophisticated transnational cybercriminal networks.