The Trump administration is weighing a substantial shift in its cyberstrategy, including by enlisting private companies to assist with offensive cyberattacks, according to four former senior U.S. officials familiar with the administration’s thinking.
The proposals have been included in drafts of the administration’s coming National Cybersecurity Strategy, which will set out general priorities and be accompanied by a plan to carry out the policies, said the former officials, who spoke on the condition of anonymity to discuss a document that was not yet public.
The government can currently contract private companies to develop elements of its cyberoperations. But the initiative would drastically expand the role of private companies in cyberwarfare, raising a host of questions about the legality and practicality of their involvement.
It would be a more aggressive approach that is likely to be the subject of a confirmation hearing on Thursday for President Trump’s nominee to lead United States Cyber Command and the National Security Agency, Lt. Gen. Joshua M. Rudd.
Under the law, private companies are prohibited from conducting offensive campaigns online, which can range from the breach that paralyzed Britain’s largest carmaker to persistent assaults targeting an opponent, like Russia’s reported attacks on Ukraine and its allies.
Changing the law to permit private companies to execute offensive cyberattacks would require congressional approval. In the past, representatives in Congress have proposed legislation that would do just that.
Recently, those proposals have re-emerged on Capitol Hill. Some lawmakers have called for private companies to be allowed to “hack back” when they come under attack, while others have suggested repurposing the Letters of Marque for cyberspace. Last authorized during the Civil War, a Letter of Marque is a constitutional provision that allows private citizens to seize enemy ships.
But the measures raise the specter of U.S.-approved piracy in cyberspace, said Lt. Gen. Charles L. Moore Jr., a retired deputy commander of U.S. Cyber Command and an author of a recent report about the role private companies could play in U.S. cyberoperations.
“If you just have companies out there hacking back, what you end up with is potential chaos in the environment,” he said.
General Moore and his co-author, Brett Goldstein, a cybersecurity expert who held senior positions in the Defense Department, pointed to those potential complications in their report, published by Vanderbilt University’s Institute of National Security.
Without Cyber Command overseeing all operations, General Moore said in an interview, “you’re going to have actions that take place by private companies against nation-states that believe that was the formal position of the United States, and now you see escalation, and potentially even kinetic conflict come of that. You’re going to see chaos.”
Trump Administration: Live Updates
Updated
- Some U.S. personnel are moved from a Qatari air base as tensions mount with Iran.
- F.B.I. agents searched the home of a Washington Post journalist for classified material.
- An initial review finds no widespread illegal voting by migrants, puncturing a Trump claim.
Having private companies answer to Cyber Command would ward against that, the authors added.
Without changing the law that prohibits private companies from engaging in offensive cyberoperations, there are several ways private-sector teams could supplement traditional military and intelligence forces, General Moore said in the interview.
The military could embed a uniformed cyberoperator in a private company to be the one who actually executes the cyberattack. Or a private company, under virtual oversight, could write code for an operation and then hand it over to Cyber Command.
General Moore and Mr. Goldstein contend that scaling up the nation’s cybercapabilities with experience from the private sector is necessary to meet the moment.
“The demand signal is too large, the threat landscape too dynamic and the technical talent pool too competitive for the department to meet future requirements with government personnel alone,” they said, referring to the Defense Department.
Turning to the private sector would allow for “a very rapid increase in scale,” which would result in more cyberattacks, General Moore said. This in turn could throw sand into the gears of enemy cyberoperations and position the United States for potential wartime actions, he added.
But whatever the role of private companies, it will still signal a significant shift in the U.S. military’s long history of teaming up with the private sector. “As a general rule, you don’t have your private-sector, defense-industrial-based companies sitting side by side with operators, conducting” offensive operations, General Moore said.
While some former officials expressed a measure of concern about the Trump administration’s plan to rely on the private sector, they welcomed its emphasis on offensive cybersecurity.
The United States has successfully conducted largely isolated offensive cybermissions, like cutting power in Venezuela’s capital during an operation to capture Nicolás Maduro, the country’s leader. But the cyberattacks have generally not amounted to broader campaigns, akin to the Salt Typhoon attack linked to the Chinese government that targeted critical U.S. infrastructure over many years.
To meet the capacity and scale of cyberattacks by American adversaries, the United States must shift the frequency of its response, moving from periodic action to persistent campaigning, General Moore said. He added that private-sector expertise was essential to achieving that goal.
Joe Lin, a former Navy Reserve officer who runs a cyberwarfare start-up called Twenty, similarly said the United States needed to be “much more proactive and pre-emptive in disrupting our adversaries, in going after our adversaries, in imposing costs on our adversaries.”
Previous administrations have not taken such an offensive approach, he said. One reason that could be changing is that “there is much more of a consensus now that offensive cyberoperations are actually much less escalatory than people previously believed that they were,” Mr. Lin said.
As someone who has experience in the military and the private sector, Mr. Lin said he saw the potential for innovative cyber start-ups to contribute to the U.S. military.
If the Trump administration indeed solicits help from private companies to augment offensive cyberoperations, Mr. Lin said, “my hope is that we won’t be the only U.S. venture-backed cyberwarfare start-up in this space, which is what we are today.”
Adam Sella covers breaking news for The Times in Washington.
The post U.S. Weighs Expanding Private Companies’ Role in Cyberwarfare appeared first on New York Times.
