You don’t have to join the hack-back program to inherit its risk
A new US presidential memorandum creates a vetted private hack-back program, leaving participating vendors and their customers with untested legal liability and collateral risks.
The August 12 National Security Presidential Memorandum directs the National Coordination Center, run jointly by DOJ and DHS, to approve covert surveillance and disruptive Cyber Effects Operations by vetted private companies, with a forfeitable bond of at least $1 million required as a contract condition. The analysis argues the criminal shield rests on an untested reading of the CFAA exemption at 18 U.S.C. 1030(f), with no civil safe harbor, no state-law preemption and no foreign-law protection. Non-participating organizations can still inherit risk through shared infrastructure collateral damage, lack of customer disclosure, Lloyd's bulletin Y5381 state-backed attack exclusions, and threat-intelligence pipelines feeding offensive proposals.
- NSPM directs DOJ and DHS to co-run the National Coordination Center program with written approval required for every operation.
- Participating companies face forfeitable bonds of at least $1 million; implementing procedures are due mid-October.
- The CFAA exemption at 18 U.S.C. 1030(f) has never been tested for private contractors, and no civil safe harbor exists.
- Lloyd's market bulletin Y5381 state-backed cyberattack exclusions may deny claims tied to government-directed operations or retaliation.
- Threat intelligence shared with ISACs or commercial platforms can feed offensive proposals under existing contract terms.
- Countries
- United States
From the original article
7 min read at csoonline.com
The obvious question about Washington’s new private offensive cyber program is which security vendors will join it. The CSO question is what happens to you when one of your vendors does. The August 12 National Security Presidential Memorandum, “Expanding Capabilities to Combat Transnational Cyber-Enabled Crime,” directs the National Coordination Center to build a program for vetted “Participating Companies.”
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.