The US government is creating a program that will allow vetted private cybersecurity companies to conduct offensive cyber operations against foreign criminal groups, under federal approval and supervision.
Companies will be able to disrupt, degrade or destroy criminal computer systems and conduct covert surveillance. Each operation will require approval from the Justice Department and Department of Homeland Security, and firms may have to provide at least $1 million in bond or escrow.
The program targets foreign cybercriminal organizations involved in ransomware, fraud and other crimes against Americans. Companies must stop and report operations if they accidentally target US persons or systems.
The move represents a major shift in US policy, which has traditionally allowed private companies to defend against hackers but not attack them. Critics warn that the new approach could create legal and security risks for participating companies.
Source: Android Authority
