US government to allow private companies to carry out cyberattacks on its behalf

Traditionally, the Computer Fraud and Abuse Act (CFAA), one of the main laws that criminalizes hacking, unauthorized computer access and other cyberattacks, has applied to private companies and individuals alike. In 2022, the Department of Justice announced that it would no longer prosecute white-hat hackers who conduct hacks for security research, but this presidential memorandum vastly expands the kinds of cyber activity the DOJ could decline to prosecute.

The details of how all of this will work are still undefined. The memorandum directs the Homeland Security Task Force to develop standards for how companies will be vetted if they want to join and procedures for how attacks will be carried out, with the details of both expected in the next 60 days. Participating companies are also required to pay a $1 million bond that will be forfeited if they don't comply with the government's direction.

While it offers an incentive to follow the government's orders and protection from US prosecution, the memorandum doesn't explain what will happen if companies or individual employees are criminally charged in the foreign countries that house the computers they're attacking. The memorandum was signed in the aftermath of a wave of cyberattacks on water facilities in Minnesota and Michigan that are now linked to Iran . The US has itself charged foreign hackers on more than one occasion . It's not hard to imagine that US-directed attacks could be met with a similar legal response.