US takes risky bet on private ‘pirates’ to combat cybercrime

San Francisco – The US will allow private companies to hack foreign cybercriminal groups, a seemingly unprecedented measure that is dividing experts, who say it has the potential to succeed or spiral out of control.

President Donald Trump inked a memorandum on Aug 12 that directed the Department of Justice and Department of Homeland Security to allow certain US companies to spy on and attack transnational criminal organisations.

The White House justified the approach by citing the damage caused by ransomware, “sextortion”, and online fraud, which it said cost Americans over US$20 billion (S$25.6 billion) in 2025.

The memorandum calls for authorising private partners to take down hackers’ servers or to infiltrate their machines with spyware. Each operation will require prior government approval, and companies will have to post a bond of at least US$1 million.

Any action that could cause death or injury is excluded, as is anything that would meet the threshold of “use of force” under international law.

The effort has parallels with 18th-century “privateering”, where governments would authorise private ships or sailors to carry out raids on enemy vessels.

“The private sector holds the data. The public sector holds the authorities”, and the new memorandum “puts them together”, Ari Redbord told AFP.

A former federal prosecutor, Redbord is now head of policy and government affairs at TRM Labs, an analytics firm that works with the US authorities.

He embraces the historical comparison with maritime privateering.

“Privateering broke down because there was no way to watch a ship once it left port. We live in a very different world than 1812... Oversight that used to end at the dock now runs alongside the operation from start to finish.”

Other experts are not convinced. “You can hand out a commission. You can’t hand out obedience,” said Alan Woodward, a cybersecurity professor at the University of Surrey.

“History’s verdict on privateering wasn’t that it was immoral. It was that it became more trouble than it was worth.”

Unexplained reversal

The effort marks a reversal for the White House, after a senior US official indicated in March it was “not interested in fighting pirates with pirates”, according to The Record news site.

National cyber director Sean Cairncross also previously ruled out using the private sector for such efforts, according to another site called CyberScoop.

It is unclear what prompted this U-turn in the span of five months.

But the programme appears to have some guard rails, said Jason Healey, a Columbia University researcher and former cybersecurity official under president George W. Bush.

“They’re backing this by the rule of law, and so I don’t feel like this is something crazy,” he said.

His concern lies elsewhere.

“This administration has systemically weakened those organisations that might provide oversight, like the Office of the Director of National Intelligence.”

US technology giants are already heavily engaged in cybersecurity efforts to defend their own products. The White House programme would allow them to go further, and operate without judicial oversight, under government oversight alone.

Microsoft declined to comment, and Google did not respond to an AFP request for comment.

Any company that participates in government-sanctioned hacking “stops being a neutral defender and becomes a target” itself, Woodward said.

The Trump administration has 60 days to finalise the programme’s details, though some aspects will remain classified.

Whether the programme ultimately succeeds or fails remains to be seen. Eventually, Washington will have to decide if the costs of the effort are worth it, such as “a slow accumulation of misattributed targets, foreign prosecutions and diplomatic headaches”, Woodward said.

Cybercrimes proliferate nonetheless.

“Short of victims getting funds back, none of the rest counts for much,” Redbord said. AFP