New US ‘hack back’ policy creates a volatile new market in cyber risk

The Trump administration has formally authorised a programme allowing government agencies to contract private cybersecurity companies for offensive operations against foreign criminal organisations. A memo signed on Wednesday establishes a framework for these firms to conduct activities including cyber surveillance and 'Cyber Effects Operations', defined as the disruption, degradation, or destruction of criminal information systems and networks. This policy, which was hinted at in the President's Cyber Strategy document from March, creates a mechanism to 'unleash the private sector' against groups that conduct cyber-enabled crime against US interests. It specifically excludes targeting entities acting on behalf of foreign governments, and operations that could result in loss of life or be considered an armed attack.

This policy represents a momentous change in the demarcation between public and private sector roles in national cybersecurity. While companies are not being given a free license to retaliate against their attackers, a select group of them will be able to act as sanctioned government proxies. Participating companies will face rigorous vetting, must adhere to strict operational procedures, and are required to post a bond of at least one million dollars, which is forfeited upon violation of their contract. The establishment of this programme creates a new, federally sanctioned market for offensive cyber capabilities, a development with profound implications for corporate risk management.

For the CFO, this policy introduces several new and complex variables into the cyber risk equation. Firstly, it creates a new class of cybersecurity vendor: one that may be simultaneously providing defensive services to your company while conducting offensive operations for the US government. This dual role could make these vendors higher-value targets for adversaries, creating a significant concentration risk for their clients. It also raises potential questions of conflict of interest that must be scrutinised during procurement and vendor management processes. The high barrier to entry, including the one-million-dollar bond, suggests this market will be served by a small number of highly resourced firms, potentially altering the competitive landscape for top-tier security services.

Finance leaders must act on this development immediately. The most urgent task is to engage with insurance brokers to understand how Directors and Officers (D&O) and cyber policies would respond in scenarios related to this new class of state-sanctioned activity. It is crucial to clarify coverage if your organisation suffers a breach linked to a vendor's participation in the programme. Furthermore, due diligence processes for all critical cyber vendors must be updated to include questions about their involvement, or intent to become involved, in these government contracts. This policy should not be viewed as a new form of protection or recourse that reduces the need for internal defence spending; rather, it is a geopolitical shift that introduces new uncertainties into an already volatile domain.