Key requirements

The memorandum establishes several guardrails for participating companies :

• $1 million escrow deposit — Participating companies must deposit $1 million in escrow, forfeitable if the government finds noncompliance with the program's rules .
• Joint DOJ/DHS sign-off — Every operation requires written approval from "Program Executive Directors" representing both the Department of Justice and the Department of Homeland Security before any action may be taken .
• Ban on targeting Americans or U.S.-based systems — The memorandum directs procedures preventing any operation from targeting U.S. persons or systems located in the United States .
• "Critical Outcomes" threshold — Operations likely to cause loss of life or serious injury, or that rise to the level of "use of force" under international law, are prohibited unless separately authorized .
• Annual reporting — The Program Executive Directors must report to the Homeland Security Advisor and National Cyber Director within 180 days and annually thereafter .
• Contractual disclosure — Participating companies must disclose to the NCC all contractual relationships with the targeted criminal organizations .

Legal and policy shift

The policy represents a historic reversal of decades of U.S. cybersecurity policy. Under the Computer Fraud and Abuse Act (CFAA), private companies have been subject to the same restrictions as any other person — broadly prohibited from conducting unauthorized access, hacking, or disruption operations without a court order . The long-standing U.S. government position, consistent across multiple administrations, has been that the private sector may defend against incoming cyberattacks but may not launch or operate offensive cyberattacks .

This memorandum sweeps that prohibition aside for vetted contractors acting under federal supervision, effectively creating a government-controlled "hack-back" program that delegates offensive cyber authority to private firms . The White House stated the policy allows the federal government to "leverage the capability and innovation of the private sector" to combat cybercrime and threats targeting Americans, such as ransomware attacks, financial scams, and sextortion .

Criticism and concerns

Critics have warned the policy is likely to face legal challenges and opposition from those who argue private companies should not be involved in government hacking operations . The memorandum itself acknowledges risk, requiring participating companies to maintain a substantial financial bond that could be forfeited for noncompliance. The program does not authorize unrestricted "hack back" operations — every action remains subject to federal approval — but critics note that delegating offensive cyber capabilities to private firms creates new avenues for potential abuse and escalation .

Key requirements

The memorandum establishes several guardrails for participating companies :

• $1 million escrow deposit — Participating companies must deposit $1 million in escrow, forfeitable if the government finds noncompliance with the program's rules .
• Joint DOJ/DHS sign-off — Every operation requires written approval from "Program Executive Directors" representing both the Department of Justice and the Department of Homeland Security before any action may be taken .
• Ban on targeting Americans or U.S.-based systems — The memorandum directs procedures preventing any operation from targeting U.S. persons or systems located in the United States .
• "Critical Outcomes" threshold — Operations likely to cause loss of life or serious injury, or that rise to the level of "use of force" under international law, are prohibited unless separately authorized .
• Annual reporting — The Program Executive Directors must report to the Homeland Security Advisor and National Cyber Director within 180 days and annually thereafter .
• Contractual disclosure — Participating companies must disclose to the NCC all contractual relationships with the targeted criminal organizations .

Legal and policy shift

The policy represents a historic reversal of decades of U.S. cybersecurity policy. Under the Computer Fraud and Abuse Act (CFAA), private companies have been subject to the same restrictions as any other person — broadly prohibited from conducting unauthorized access, hacking, or disruption operations without a court order . The long-standing U.S. government position, consistent across multiple administrations, has been that the private sector may defend against incoming cyberattacks but may not launch or operate offensive cyberattacks .

This memorandum sweeps that prohibition aside for vetted contractors acting under federal supervision, effectively creating a government-controlled "hack-back" program that delegates offensive cyber authority to private firms . The White House stated the policy allows the federal government to "leverage the capability and innovation of the private sector" to combat cybercrime and threats targeting Americans, such as ransomware attacks, financial scams, and sextortion .

Criticism and concerns

Critics have warned the policy is likely to face legal challenges and opposition from those who argue private companies should not be involved in government hacking operations . The memorandum itself acknowledges risk, requiring participating companies to maintain a substantial financial bond that could be forfeited for noncompliance. The program does not authorize unrestricted "hack back" operations — every action remains subject to federal approval — but critics note that delegating offensive cyber capabilities to private firms creates new avenues for potential abuse and escalation .