US to License Private Firms for Hacking Crypto Scam Networks

To enter the program, a company must sign a contract with the Department of Justice or the Department of Homeland Security. It must pass a vetting process and get written authorization before each mission. Two executive directors oversee the system, one from Justice and one from Homeland Security. The government may require a $1 million bond or escrow deposit from participating firms to cover certain cases of non-compliance.

The scope of allowed operations is broad. Cyber surveillance covers clandestine information gathering and may involve unauthorized access to a system. Cyber effects operations can manipulate, disrupt, degrade, or destroy systems or the data they contain. Operations likely to cause death or serious injury, or involving the use of force under international law, are beyond the delegated approval authority of the program directors, the memo states.

The biggest open question is liability. The public version of the memo does not detail what role an independent authority would play in the event of an error or collateral damage. The government will retain oversight, but the procedures due within 60 days must establish targeting, coordination, and cessation rules for an operation that mistakenly affects a U.S. person or system. A report is due within 180 days, with annual evaluations thereafter.

For crypto users, the program's impact will depend less on how many networks are infiltrated than on whether it prevents new victims and can recover stolen funds. The next 60 days will reveal how far Washington intends to delegate its cyber capabilities to the private sector.