In a first, US will allow some private firms to carry out cyberattacks