Senate Considers Letting Contractors Hack Computers for Military

Contractors would be allowed to conduct military hacking operations with US government approval under a Senate defense bill that would mark the first time Congress has explicitly authorized the private sector to conduct offensive cyber missions.

The Senate’s proposal for a fiscal 2027 Pentagon spending authorization bill contains a provision to create a pilot program allowing the US military to contract with companies to conduct cyber operations. The missions would take place under the authority of Cyber Command, the military’s cyberwarfare unit whose work includes supporting US military foreign operations, and they would be overseen by Pentagon personnel.

Cyber Command referred questions to Pentagon officials, who didn’t respond to a request for comment.

The Senate proposal follows the administration’s National Cybersecurity Strategy, which was released in March and promised to “unleash the private sector” and to “identify and disrupt adversary networks and scale our national capabilities.”

The Trump administration has already taken steps this year to expand the private sector’s role in hacking operations, which have historically been performed by the government’s military, intelligence and law enforcement agencies.

Earlier this summer, a White House presidential memorandum created a program allowing American firms to hack and disrupt “foreign cyber-enabled transnational criminal organizations.” That program will run under the authority and oversight of the Justice Department and the Department of Homeland Security.

The Senate proposal is limited to allowing companies to hack targets for the purpose of “access generation,” meaning to break into systems targeted by the US military. In contrast, the White House program explicitly allows firms to conduct “cyber effects operations” which can result in disruption or destruction of targets.

Read More: Trump Enlists Private Sector to Boost Cyber-Offensive Arsenal

Cyber Command is undergoing a major overhaul dubbed “Cybercom 2.0.” The effort is driven by a consensus that the 16-year-old command requires reform to adapt to modern challenges such as AI, a persistent talent shortage and an ongoing war. The debate about how to fix the command’s woes remains fierce and open.

Critics of the privatization of military hacking operations argue that creating a for-profit American hacking industry creates risks of widespread retaliation, unintended escalation and a lack of adequate oversight. Instead, they argue the focus should be on reforming Cyber Command.

Boosters of the effort, including inside the Trump administration, increasingly see private sector hackers as a way to address the government’s cybersecurity shortcomings.

If the proposal becomes law, the pilot program would begin by March 1, 2027, and expire by Dec. 31, 2030. It would require the Pentagon to report to Congress about specific contracts and operations, including information on targets, as well as to brief lawmakers quarterly about all activities under the program.

The Senate proposal in this year’s National Defense Authorization Act is not yet law, but the bill is considered must-pass legislation and usually wins bipartisan support. The Senate still has to vote on the measure, and it could be altered beforehand. In addition, the Senate has to negotiate the final bill with the House before the president signs it. The House didn’t include a similar provision in its defense authorization bill.

The new proposed legislation comes as Cyber Command personnel have seen their workloads surge significantly over the last year while the US has engaged in multiple overseas conflicts.

The burden often falls on the shoulders of the command’s cyber analysts and operators, the military’s term of art for hackers, in the form of continued surges, longer hours and intensifying pressure. The sustainability and mental health of Cyber Command’s top personnel has been a concern inside the command and in Congress for years. Cyber Command officials plan to brief Congress on Thursday as part of lawmakers’ examination into a spike in deaths by suicide at the unit, Bloomberg reported.