The New US Policy Letting Private Companies Hack Foreign Cybercriminals

On August 12, 2026, President Trump signed a National Security Presidential Memorandum titled "Expanding Capabilities to Combat Transnational Cyber-Enabled Crime" that, for the first time, authorizes vetted private U.S. companies to conduct offensive cyber operations — including surveillance and disruptive attacks — against foreign cyber-enabled transnational criminal organizations (CE-TCOs) . The policy marks a seismic shift in U.S. cybersecurity doctrine, moving from a strict prohibition on private-sector hacking to a federally supervised program that enlists private firms as offensive cyber operators.

What the policy does

The memorandum directs the National Coordination Center (NCC) to create and manage a program that authorizes "Participating Companies" to conduct "Cyber Effects Operations" — defined as activity that manipulates, disrupts, denies, degrades, or destroys information systems, networks, or data — against foreign criminal networks that target Americans . Operations can include covert surveillance (e.g., deploying spyware to collect intelligence) and disruptive attacks aimed at destroying criminals' data or systems . The program also allows for "Cyber Surveillance Operations" as a separate authorized activity .

Key requirements

The memorandum establishes several guardrails for participating companies :

• $1 million escrow deposit — Participating companies must deposit $1 million in escrow, forfeitable if the government finds noncompliance with the program's rules .
• Joint DOJ/DHS sign-off — Every operation requires written approval from "Program Executive Directors" representing both the Department of Justice and the Department of Homeland Security before any action may be taken .
• Ban on targeting Americans or U.S.-based systems — The memorandum directs procedures preventing any operation from targeting U.S. persons or systems located in the United States .
• "Critical Outcomes" threshold — Operations likely to cause loss of life or serious injury, or that rise to the level of "use of force" under international law, are prohibited unless separately authorized .
• Annual reporting — The Program Executive Directors must report to the Homeland Security Advisor and National Cyber Director within 180 days and annually thereafter .
• Contractual disclosure — Participating companies must disclose to the NCC all contractual relationships with the targeted criminal organizations .

Legal and policy shift

The policy represents a historic reversal of decades of U.S. cybersecurity policy. Under the Computer Fraud and Abuse Act (CFAA), private companies have been subject to the same restrictions as any other person — broadly prohibited from conducting unauthorized access, hacking, or disruption operations without a court order . The long-standing U.S. government position, consistent across multiple administrations, has been that the private sector may defend against incoming cyberattacks but may not launch or operate offensive cyberattacks .

This memorandum sweeps that prohibition aside for vetted contractors acting under federal supervision, effectively creating a government-controlled "hack-back" program that delegates offensive cyber authority to private firms . The White House stated the policy allows the federal government to "leverage the capability and innovation of the private sector" to combat cybercrime and threats targeting Americans, such as ransomware attacks, financial scams, and sextortion .

Criticism and concerns

Critics have warned the policy is likely to face legal challenges and opposition from those who argue private companies should not be involved in government hacking operations . The memorandum itself acknowledges risk, requiring participating companies to maintain a substantial financial bond that could be forfeited for noncompliance. The program does not authorize unrestricted "hack back" operations — every action remains subject to federal approval — but critics note that delegating offensive cyber capabilities to private firms creates new avenues for potential abuse and escalation .