US takes risky bet on private ‘pirates’ to combat cybercrime

San Francisco – The United States will allow private companies to hack foreign cybercriminal groups, a seemingly unprecedented measure that is dividing experts who say it has potential to succeed or spiral out of control.

President Donald Trump signed a memorandum on Aug 12 that directed the departments of Justice and Homeland Security to allow certain US companies to spy on and attack transnational criminal organisations.

The White House justified the approach by citing the damage caused by ransomware, “sextortion”, and online fraud, which it said cost Americans more than US$20 billion (S$26 billion) in 2025.

The memorandum calls for authorising private partners to take down hackers’ servers or to infiltrate their machines with spyware.

Each operation will require prior government approval, and companies will have to post a bond of at least US$1 million.

Any action that could cause death or injury is excluded, as is anything that would meet the threshold of “use of force” under international law.

The effort has parallels with 18th century “privateering”, when governments would authorise private ships or sailors to carry out raids on enemy vessels.

“The private sector holds the data. The public sector holds the authorities,” and the new memorandum “puts them together,” Ari Redbord told AFP.

A former federal prosecutor, Redbord is now head of policy and government affairs at TRM Labs, an analytics firm that works with US authorities.

He embraces the historical comparison to maritime privateering.

“Privateering broke down because there was no way to watch a ship once it left port,” Redbord said. “We live in a very different world than 1812... Oversight that used to end at the dock now runs alongside the operation from start to finish.”

Other experts are not convinced.

“You can hand out a commission. You can’t hand out obedience,” University of Surrey cybersecurity professor Alan Woodward told AFP.

“History’s verdict on privateering wasn’t that it was immoral. It was that it became more trouble than it was worth,” he continued.

Unexplained reversal

The effort marks a reversal for the White House, after a senior US official indicated in March it was “not interested in fighting pirates with pirates”, according to The Record news site.

National Cyber Director Sean Cairncross also previously ruled out using the private sector for such efforts, according to another site called CyberScoop.

It is unclear what prompted this U-turn in the span of five months.

However, the program appears to have some guardrails, Jason Healey, a Columbia University researcher and former cybersecurity official under President George W. Bush, told AFP.

“They’re backing this by the rule of law, and so I don’t feel like this is something crazy,” Healey said.

His concern lies elsewhere.

“This administration has systemically weakened those organisations that might provide oversight, like the Office of the Director of National Intelligence,” Healey said.

US tech giants are already heavily engaged in cybersecurity efforts to defend their own products.

The White House program would allow them to go further, and operate without judicial oversight, under government oversight alone.

Microsoft declined to comment, and Google did not respond to an AFP request for comment.

Any company that participates in government-sanctioned hacking “stops being a neutral defender and becomes a target” itself, Woodward said.

The Trump administration has 60 days to finalise the program’s details, though some aspects will remain classified.

Whether the program ultimately succeeds or fails remains to be seen.

Eventually, Washington will have to decide if the costs of the effort are worth it, such as “a slow accumulation of misattributed targets, foreign prosecutions and diplomatic headaches,” Woodward said.

Cybercrimes proliferate nonetheless.

“Short of victims getting funds back, none of the rest counts for much,” Redbord said. AFP