Why US is allowing American private firms to become ‘hackers for hire’

Transnational Criminal Organisations (TCOs) are organised criminal networks whose activities extend across national borders, often using jurisdictions outside of a country to target another’s citizens, companies or infrastructure. In the context of Trump’s new cyber programme, the term refers specifically to foreign-based criminal organisations using digital systems to carry out crimes against US persons or interests, including ransomware, fraud, extortion, and attacks on computer networks.

“By partnering with vetted United States companies…we will enhance our ability to counter TCO threats and combat transnational cybercrime, fraud, and other predatory schemes against American citizens,” the memorandum said.

The move marks an unusual expansion of the private sector’s role into an area that has largely remained the preserve of intelligence agencies, law enforcement, and military cyber units. The White House’s argument is that American cybersecurity and technology companies possess capabilities that have so far been “underutilised” against ransomware gangs, fraud networks and other criminal outfits operating beyond US borders.

How will the programme work?

The programme will be run by the National Coordination Center under the Homeland Security Task Force, and jointly overseen by officials nominated by the Department of Justice and Department of Homeland Security.

Companies seeking to participate will have to sign contracts with either department and pass checks covering their technical abilities, previous cyber operations, personnel, reliability, and physical security. Both large technology companies and smaller specialist cyber firms are meant to be eligible.

Once inside the programme, companies could receive information about criminal networks from government agencies or other businesses, and use it to propose operations. Their work could involve secretly accessing a computer system without its owner’s permission to collect information, manipulate, disrupt, deny access to, degrade or destroy computer systems, networks, data and even physical infrastructure controlled by those systems.

The targets, however, are supposed to be criminal organisations attacking US persons or interests, and not entities that are formally part of a foreign government or wholly under its direction.

There are nevertheless unresolved risks. Cyber attackers routinely hide behind compromised computers belonging to innocent organisations, making attribution, and avoiding collateral damage, difficult.

Echoes of China and Russia

The approach has a striking parallel with a model Washington has repeatedly accused China and Russia of using — that is, mobilising private or nominally independent hackers to extend the state’s cyber capabilities.

In China, US authorities have described an extensive “hacker-for-hire” ecosystem in which private cybersecurity companies and freelance hackers work for Beijing. Last year, the FBI said that a private firm worked with the Chinese government, with its prosecutors alleging that the firm’s hackers sometimes took government assignments and sometimes hacked targets independently before trying to sell the stolen information to state agencies.

Russia’s model is even less formal. Research by the UK-based policy think-tank Chatham House has described an ecosystem ranging from criminal gangs and hacktivists to private companies, some directly linked to intelligence agencies, some financially supported, and others simply tolerated as long as their activities broadly serve Russian interests. That ambiguity also provides Moscow with plausible deniability.

The American model, while not entirely identical, does signal an underlying shift in US policy. After years of criticising adversaries for drawing non-state actors into their cyber campaigns, Washington is now building its own formal mechanism to tap private hacking expertise, and take the fight outside American networks.