Those who engage in this better have good insurance. Ruin people's stuff, they're going to sue

I think the expectation is far different than reality. This isn't about google's TAG hacking back FIN7. This is about LockMart extending their contract from vulnerability research, to throwing these vulnerabilities. They've wanted this expansion for some time now.

And with cybercom doing literally everything it can to resist becoming a separate service, I guess now is the time interests aligned.

So imagine taking everything that was wrong with the f35's acquisition and technical ownership and supply chain. And shift it wholesale over to cyber. So we're now paying for each exploit's development, and also paying a per use fee at a cost+plus rate, never truly owning anything

With some of these cybercrime groups, being sued is probably the least of their worries..

Hmm, the fancy interoffice memo plan says that participants will be required to put at least $1m in escrow... but it doesn't say those funds are for paying liability or damages to people they hurt!

Instead, it's money to be simply forfeited to the US treasury [0] if the contractor breaks some to-be-determined conditions in not-yet-existing contracts. In other words, its a money-hostage for obedience.

[0] At least, that would be the legal default, but I'd watch carefully to make sure it doesn't somehow get stolen into an Executive Branch slush-fund.