Policy shift enables private firms to hack overseas, signaling major cybersecurity regulatory change.