jain.com — data centers, connectivity and security, analyzed daily

Tag: cyber policy

  • Hack-Back Memo Puts State Hackers Out of Scope, Despite Attacks on 45 Water Systems

    Hack-Back Memo Puts State Hackers Out of Scope, Despite Attacks on 45 Water Systems

    TL;DR · 30-second read

    The Short Version

    The American government will now let approved private companies break into, and even wreck, computers run by foreign criminal hacking gangs. In March, officials said they would not do this.

    Each company must set aside at least $1 million, which it loses if it breaks the rules. Every attack needs written approval from the Justice Department and Homeland Security.

    The catch: hackers working directly for a foreign government are off-limits. That matters because the order came after suspected Iranian attacks on water suppliers in 45 American towns.

    Tom’s Hardware reported that President Donald Trump signed a presidential memorandum on August 12 creating the first US program that lets vetted private companies conduct offensive cyber operations against foreign cybercrime organizations. These include operations that destroy data and systems. Participating firms must post at least $1 million in escrow, which they forfeit if they break program rules. Every operation needs written approval from Department of Justice and Department of Homeland Security officials.

    A National Coordination Center will run the program. Implementation guidance is due within 60 days. The policy reverses public statements administration officials made in March.

    Executive Summary

    The memorandum authorizes two kinds of activity. “Cyber Surveillance Operations” means getting into foreign systems without permission to gather intelligence while staying undetected. “Cyber Effects Operations” means disrupting or destroying those systems and their data. Both large firms and smaller specialists will be eligible. Participants may also sign commercial deals with other private firms and with state and local agencies to receive threat data and propose operations based on it.

    This matters for two reasons. First, it turns offensive cyber activity, long treated as a government monopoly in the US, into something a licensed private sector can do under supervision. Second, its target definition is narrow. A group qualifies as a target unless “clear intelligence exists” that it is part of a foreign government or wholly run at a government’s direction. So the program is aimed at criminal ransomware crews, not at the state-directed actors behind many attacks on physical infrastructure. For operators of water, power and data center infrastructure, that distinction shapes what the program can and cannot do for them.

    The Target Line Runs Straight Through Critical Infrastructure

    The memo arrived after suspected Iranian cyberattacks on water suppliers in 45 US municipalities. It also followed a CISA alert about Iranian hackers targeting programmable logic controllers (PLCs), the small industrial computers that open valves, run pumps and switch equipment at water and energy companies. Yet state-directed hackers fall outside the program’s own definition of a valid target. Private operators could go after a ransomware crew that encrypts a utility’s billing systems. They could not go after a government-run unit tampering with its treatment-plant controllers.

    The line is drawn deliberately. Ransomware crews that operate with a state’s tolerance but not under its formal control stay within scope, a description that fits much of the Russia-based ransomware ecosystem. Once an actor is clearly an arm of a foreign state, the matter stays with government. For utility and industrial security teams, the practical conclusion is that nothing changes for defending operational technology against nation-state intrusion. Segmentation, monitoring and incident response for control systems remain their responsibility. The new program targets the financially motivated threat, not the geopolitical one.

    There is also an ambiguity problem. Eligibility turns on whether “clear intelligence” ties a group to a government, and in practice attribution is often contested and slow. A group judged criminal today may later prove to have state links. That question will matter a great deal to any firm whose operation lands on the wrong side of the line.

    A $1 Million Bond on a Destructive Capability

    The escrow requirement is the program’s main economic control. A minimum of $1 million, forfeited for rule-breaking, is a meaningful commitment for a small specialist firm. Whether it is proportionate to the harm a destructive operation could cause is a separate question. Wiping servers that turn out to be shared with innocent third parties could produce losses well above that figure. The minimum works as a deterrent and an entry filter. It is not obviously a compensation fund.

    The commercial provisions may matter more for the market’s shape. Participants can contract with other private firms and with state and local agencies, receive threat data and propose operations based on it. That creates a potential new service line for security vendors: selling disruption, not just detection. Two background facts point the same way. Congress earmarked $1 billion for offensive cyber operations in last year’s spending bill. Google said in August last year that it was preparing to take part in disruptive actions against cybercriminals. Large platform companies with deep telemetry into criminal infrastructure look like natural participants. Smaller firms may compete on specialized tasks, as the eligibility rules anticipate.

    Escalation, Legal Exposure and a Classified Annex

    DOJ and DHS officials cannot approve operations likely to cause loss of life or amount to an armed attack under international law. The memo does not prohibit such operations outright, however. Approval authority for them sits in a classified annex. Companies weighing participation, and the public, therefore cannot see the full rulebook for the highest-risk cases.

    Personnel face exposure too. Jake Williams, vice president of research and development at Hunter Strategy, told TechCrunch that Americans involved in these operations “could easily be classified as non-uniformed combatants while traveling overseas.” That is a risk that falls on individual employees, not only on their employers, and firms will need to account for it in staffing, travel policy and insurance.

    The speed of the reversal adds uncertainty. In March, Thomas Lind, then a senior adviser at the Office of the National Cyber Director, said the administration had no plans to authorize private offensive operations: “We’re not interested in fighting pirates with pirates.” National Cyber Director Sean Cairncross said the same week that companies running offensive campaigns were not what the administration meant when it asked industry for help. A policy that changed direction within months could change again, which makes long-term investment in offensive capability a harder bet.

    Collateral Risk Is Written Into the Rules

    The memo requires any company that unintentionally hits a US person or a system on US soil to halt operations and notify the government immediately. That clause concedes that operations aimed abroad can land at home. Criminal groups commonly route activity through rented servers and compromised machines owned by unrelated parties. Hosting providers, cloud platforms and data center operators therefore have a direct interest in how approvals weigh that possibility, and in how quickly they would be told if their infrastructure were affected.

    Defenders more broadly face a quieter risk: retaliation. A criminal group whose systems are destroyed by a US firm may not distinguish between that firm and US targets generally. The memo’s safeguards govern how operations are approved. They do not change who absorbs the response.

    Background

    For decades, US law and policy have treated breaking into someone else’s computer as illegal, even when that someone is an attacker. Offensive cyber operations have been reserved for government agencies such as the military and intelligence community. Proposals to let private victims “hack back,” including the Active Cyber Defense Certainty Act introduced in Congress in 2017, never became law. Critics warned of misattribution, collateral damage and escalation.

    Pressure grew as ransomware crews, many operating from jurisdictions beyond the reach of US law enforcement, hit hospitals, pipelines and municipalities. Some large technology firms have already worked with authorities to take down criminal infrastructure, and Google said last year it was preparing to take part in disruptive actions. The August 12 memorandum is the first formal framework for private firms to go further, under federal supervision.

    Sources

    Source: White House authorizes private companies to launch ‘hack-back’ cyberattacks that destroy data and systems, targeting foreign cybercrime organizations. Tom’s Hardware on the August 12 presidential memorandum creating a supervised private offensive cyber program.

  • Industry Coalition Aims to Lead US Critical Infrastructure Cyber Defense

    Industry Coalition Aims to Lead US Critical Infrastructure Cyber Defense

    A newly formed cybersecurity industry coalition has said it intends to take a leading role in protecting United States critical infrastructure — the power grids, pipelines, water systems, telecommunications networks and data centers that other services depend on. The formation was reported on 11 May 2026 by Cybersecurity Dive.

    The coverage available to us is headline-level: it establishes that the coalition exists and states its ambition, but the membership roster, funding model, governance structure and operating timeline are not detailed in the material we can verify. This article analyzes the structural question the announcement raises — what an industry-led body can and cannot do for national cyber defense — and sets out the specifics that remain open.

    Executive Summary

    The announcement is best understood as a positioning move in a shifting division of labor. For roughly a decade, US critical infrastructure cyber defense has been organized around a federal hub — the Cybersecurity and Infrastructure Security Agency (CISA) — surrounded by sector-specific industry groups. Through 2025 and into 2026, CISA absorbed widely reported workforce reductions and proposed budget cuts, while the statutory liability protections that encouraged companies to share threat data with the government lapsed in late 2025 and became the subject of ongoing legislative debate. A vacuum, real or anticipated, invites someone to fill it.

    Why it matters for infrastructure operators: cyber defense at national scale is fundamentally a coordination problem, not a product problem. Attacks on one utility or carrier are previews of attacks on the next, and the value of any defensive body lies almost entirely in how fast and how completely warning travels between competitors. Whoever convenes that exchange sets the terms — what gets shared, with whom, under what legal cover, and at what price.

    What is not yet established: the coalition’s claim to leadership is, at this stage, a stated intention rather than a demonstrated capability. Nothing in the available reporting confirms who has joined, what the group will fund, or how it will relate to the federal agencies and existing sector bodies already occupying this space. Those are the tests worth applying, and they are answerable within months.

    Why Industry Is Volunteering for a Job It Once Resisted

    For most of the past decade, the private sector’s posture toward critical infrastructure cybersecurity policy was defensive: resist mandates, negotiate reporting rules, worry aloud about liability. A coalition announcing that it intends to lead is a notable inversion. The plainest explanation is not altruism but exposure. Roughly the great majority of US critical infrastructure is privately owned and operated, which means the operators absorb the losses — outage costs, ransom payments, regulatory penalties, insurance repricing — regardless of who holds the coordinating role in Washington.

    If federal coordinating capacity contracts, the risk does not disperse; it lands on balance sheets. Under those conditions, funding a shared defensive apparatus becomes a rational cost, in the same way that competing airlines jointly fund safety data programs because a crash at one carrier damages all of them. The economics here are the economics of a public good that private parties have decided to buy for themselves.

    The counter-reading deserves equal weight. Industry coalitions are also lobbying vehicles, and a group that positions itself as the operational leader of critical infrastructure defense acquires substantial influence over the regulation of its own members — including which standards become de facto requirements and which incidents are deemed reportable. Neither reading is disprovable from a formation announcement. Both should be held open until the governance documents appear.

    What a Coalition Can Do — and What Only Governments Can

    A well-run private body can do a great deal. It can pool threat intelligence faster than any agency clears it; it can run joint exercises, publish detection signatures, fund shared tooling for smaller utilities that cannot afford their own security teams, and set procurement standards that vendors must meet to sell into the sector. These are genuine capabilities, and where they already exist — in the sector-based Information Sharing and Analysis Centers, or ISACs, and in cross-vendor groups like the Cyber Threat Alliance — they have measurable value.

    What no coalition can do is exercise state power. It cannot compel a reluctant operator to patch, cannot seize infrastructure used by an adversary, cannot see foreign signals intelligence, cannot indict anyone, and cannot grant legal immunity to a company that hands over customer-adjacent telemetry. That last point is not a technicality. The 2015 information-sharing framework worked largely because it told general counsels that sharing indicators would not create antitrust or privacy liability. With that protection lapsed and its restoration unresolved, a private coalition asking members to share aggressively is asking them to accept legal risk that only Congress can remove.

    The realistic model, then, is complementary rather than substitutive. Industry can carry operational tempo — the fast, technical, day-to-day work of spotting and blocking. Government retains the coercive and intelligence functions. The failure mode to watch for is a coalition that markets itself as a replacement for federal capacity, because that framing tends to reduce political pressure to fund the functions industry structurally cannot perform.

    Winners, Losers, and Who Pays for Coordination

    If the coalition matures, the clearest beneficiaries are large operators with mature security programs. They already generate high-quality telemetry, they can absorb membership costs, and they gain influence over standards they were going to meet anyway. Hyperscale cloud providers and major data center and network operators sit in a particularly strong position: they see enormous volumes of attack traffic, which makes them the most valuable contributors and therefore the most powerful voices at the table.

    The parties at risk of being left out are the ones the country most needs covered — small municipal water systems, rural electric cooperatives, regional hospitals, mid-sized carriers. These organizations often run legacy operational technology, employ few or no dedicated security staff, and cannot pay meaningful dues. Any coalition serious about critical infrastructure rather than large enterprise defense has to answer how those operators are subsidized. A pricing model that tracks ability to pay is a strong signal of seriousness; a flat corporate membership fee is a signal that the group’s practical scope is narrower than its name.

    There is also a vendor question worth watching without prejudging it. Security suppliers have a legitimate operational role in any such body — they hold much of the visibility — and also a commercial interest in defining the standards their products satisfy. Governance that separates threat-sharing operations from standards-setting, with disclosed member lists and recusal rules, is the ordinary remedy. Its presence or absence will be visible in the founding documents.

    The Evidence Test to Apply Over the Next Two Quarters

    Announcements of this kind are cheap; sustained coordination is expensive. Four observable markers separate the two. First, a published member list with named operators from more than one sector — a coalition drawn from a single industry is a trade association with a broader title. Second, a funded budget and paid technical staff, rather than a volunteer steering committee. Third, a concrete first deliverable with a date: a joint exercise, a shared detection feed, a subsidized tooling program for small utilities.

    Fourth, and most diagnostic, an explicit statement of how the group relates to CISA, to the sector coordinating councils, and to the existing ISACs. Critical infrastructure defense is not an empty field; it is a crowded one with a decade of institutional plumbing. A new body that names its interfaces is doing engineering. A new body that does not is, for now, doing communications.

    None of this is a reason for skepticism about the underlying need. The threat picture that plausibly motivated the coalition — persistent adversary pre-positioning inside operational technology networks, ransomware against hospitals and municipalities, the exposure of long software supply chains — is well documented and does not depend on this announcement being substantive. The question is narrower and fairer: whether this particular vehicle is built to carry that weight.

    Background

    US critical infrastructure cyber defense has been organized since the mid-2010s around a public-private model: a federal coordinating hub, formalized as CISA in 2018, working alongside sector coordinating councils and the Information Sharing and Analysis Centers that circulate threat data within industries. The Cybersecurity Information Sharing Act of 2015 supplied the legal foundation, giving companies liability protection for passing indicators of compromise to the government and to each other. In 2021, CISA added the Joint Cyber Defense Collaborative to bring major technology and security firms into planning alongside federal agencies.

    That arrangement has come under strain. CISA sustained widely reported staffing reductions and proposed budget cuts through 2025 and into 2026, while the 2015 law’s information-sharing protections lapsed in late 2025 with restoration still contested in Congress. At the same time, publicly documented threats to operational technology networks — the industrial control systems that run grids, pipelines and water treatment — have grown more persistent. Roughly the great majority of the affected assets are privately held, meaning the operators carry the financial consequences regardless of how federal capacity evolves. That combination is the setting into which this coalition has announced itself.

    Source: New cybersecurity industry coalition aims to lead US critical infrastructure protection — Cybersecurity Dive, 11 May 2026, reporting the formation of an industry group intending to take a leading role in US critical infrastructure cyber defense.