The Trump administration is enlisting private companies to conduct cyberattacks on foreign cybercriminals in a major policy shift that experts say could come with legal risk for the companies.

The move gives vetted companies a prominent role in hacking operations that have historically been the dominion of US law enforcement, spy and military agencies.

Companies can use cyber tools to surveil foreign criminals and disrupt their networks under the “control and oversight” of the new federal program, according to a memo issued Wednesday by President Donald Trump.

The program’s goal is to punish foreign criminal groups that cause Americans billions of dollars in annual losses. The program’s remit is foreign criminal groups, not governments.

“American businesses’ innovative capabilities have historically been underutilized in efforts to identify and disrupt criminal networks operating in cyberspace,” the memo says.

The US government is already doing a lot of hacking on foreign targets. The new program risks having too many cooks in the kitchen, some former officials said.

“The real risk is that you end up with a bunch of cyber privateers running around without any clear coordination or direction at the federal level,” said Andrew Schoka, a former Army officer at US Cyber Command.

Deconflicting in cyber operations “is already a major challenge for federal agencies, but now you’re adding in the complexity of private sector firms with a lot more capability and speed,” Schoka told CNN.

The new program could free up US government resources. Chinese government-backed hackers outnumber FBI cyber personnel 50-to-1, according to former FBI director Christopher Wray.

“Having private sector help to counter cyber criminals allows the US to disrupt more groups and frees up agencies like FBI and Cyber Command to focus more on countering nation states like China,” said Cynthia Kaiser, a former senior FBI cyber official.

“But the devil is in the details,” Kaiser told CNN. “Before they sign up, companies will need more explicit information about liability protections, types of government oversight, and foreign criminal use of US infrastructure, among other concerns.”

An explosion of scams targeting every type of American in recent years has prompted some private citizens to hack back and compromise the networks of the scammers.

Chris “Weld Pond” Wysopal, co-founder of cybersecurity firm Veracode, said the new federal program would be a more organized way of dealing with the problem. But he also worried about the potential consequences of a government-sanctioned hacking operation carried out by a private firm that goes awry. Hacking a data center in a foreign country to target scammers could, for example, inadvertently affect a hospital, he said.

Foreign governments may also see employees of companies participating in the new hacking program who travel abroad as legitimate targets for detention or questioning, Wysopal said.

Officials from the departments of Justice and Homeland Security will oversee the new hacking group. Any program activity “directed at a United States person” must undergo extra legal scrutiny, including from the Justice Department, the memo says.

But Jason Kikta, a former Cyber Command official, said the new memo didn’t lay out a clear process for ensuring cyber operations uphold the civil liberties of American citizens.

“There is no clear oversight or review process on the determinations that will be made by unnamed political appointees,” Kikta said. “Defenders (of the memo) will say that it still requires activity to be constrained by DOJ and DHS authorities. But this order pushes liability on to the companies.” (CNN)

Update news