The goal is to let private companies take on foreign cyber criminals, but the unprecedented approach raises plenty of questions about oversight and liability. President Donald Trump’s order to “unleash” the private sector to conduct offensive cyber operations against foreign criminal hackers is raising novel questions about government oversight, as well as legal liability and other risks for private companies that enlist in the program. The national security presidential memorandum signed by Trump this week does not enable private sector companies to “hack back” when they face a cyber intrusion. Instead, it establishes a government-run program that will contract with private sector companies and approve any offensive cyber operations conducted by industry participants. The new directive follows the White House’s national cyber strategy, released in March, which says the Trump administration will “unleash the private sector by creating incentives to identify and disrupt adversary networks and scale our national capabilities.” Trump’s memo directs the National Coordination Center to create and manage a program that authorizes companies to take offensive cyber action against “cyber-enabled transnational criminal organizations.” The Department of Homeland Security and the Justice Department will each designate a program executive director to co-lead the program. “Cyber operations shall only be approved after coordination between the program executive directors, and any resulting operational action will be exclusively conducted on behalf of and under the supervision of the federal government pursuant to the federal government’s lawful authorities,” the memo states. Tonya Ugoretz, former assistant director of intelligence at the FBI’s directorate of intelligence, said the directive is “a novel approach to what’s proved to be an intractable problem of cyber-enabled crime that we know affects every U.S. citizen to the tune of billions of dollars per year.” Ugoretz is currently the leader of PwC’s Cyber & Risk Innovation Institute. “These cybercriminal