FOLLOW US

President Donald Trump signed a memo clearing the way for vetted American companies to launch their own offensive cyberattacks against foreign criminal hacking groups, a sharp break from decades of policy that kept offensive hacking strictly in the hands of the military and intelligence agencies.

Under the national security memorandum, companies that sign up would work directly with the Justice and Homeland Security Departments, which would vet participants, approve individual operations in writing, and oversee the program through a new coordination center inside DHS.

The White House has framed it as a way to tap into what one administration memo called the "underutilized" capabilities of the private sector against a wave of ransomware, fraud and other cybercrime that costs Americans billions of dollars a year.

How the Program Would Actually Work

Participating firms would be limited to two categories of activity, surveillance operations to gather intelligence on criminal networks, and what the memo calls cyber effects operations, which can disrupt, degrade or even destroy the systems those networks rely on. Companies would have to post a bond of at least $1 million and could face steep fines if they break the rules.

Operations cannot risk loss of life or serious injury, and nothing is allowed to rise to what international law would consider a use of force. The targets are meant to be transnational criminal organizations rather than foreign governments, though the memo leaves room to go after state linked hackers if intelligence ties them to a criminal network. A classified annex is supposed to keep private operations from colliding with whatever the government's own hackers are doing at the same time.

Why Washington Wants Private Companies Hacking Back

Officials argue the government simply doesn't have the manpower to keep up. Former FBI director Christopher Wray has said Chinese government-backed hackers outnumber the bureau's own cyber personnel by roughly 50 to 1.

Cynthia Kaiser, a former senior FBI cyber official, said pulling private companies into the fight against criminal hackers could free up agencies like the FBI and Cyber Command to spend more time on nation-state threats such as China. National Security Council cyberpolicy director Amanda Naylor said the memo would give the country "new tools to protect Americans from cybercrime and fraud."

The Part That Worries Security Experts

Critics see a program that looks a lot like what rival powers already do. Dakota Cary, an adviser at the cybersecurity firm SentinelOne, put it bluntly, saying the U.S. now appears to be copying China's own approach of deputizing private hackers. Others worry about simple mistakes with real consequences.

Chris Wysopal, co-founder of the cybersecurity firm Veracode, pointed out that hacking a data center overseas to hit scammers could accidentally take down something as sensitive as a hospital, and warned that employees of participating firms who travel abroad could become targets for foreign governments looking to detain or question them.

Jason Kikta, a former U.S. Cyber Command official, said the memo offers no clear process for reviewing decisions made by "unnamed political appointees" while shifting legal liability onto the companies themselves. And several experts flagged a more basic problem, attribution. It is often genuinely difficult to know whether a hacking group is truly independent or secretly doing work for a foreign spy agency, something even government analysts still struggle with.

The White House has not said which companies, if any, are expected to sign on, and the administration did not brief reporters before releasing the memo.