Cybersecurity Policy Report, White House Wants U.S. Companies to Hack Overseas Cyber Criminals, (Aug 13, 2026)
Vetted U.S. companies will be allowed to launch offensive cyber operations against overseas cyber criminals under a national security presidential memorandum (NSPM) issued yesterday by the White House.
“The American private sector is the most innovative and technologically advanced in the world, and its scale, speed, and capacity secure a critical offensive cyber advantage for the United States,” the NSPM notes.
“Yet, American businesses’ innovative capabilities have historically been underutilized in efforts to identify and disrupt criminal networks operating in cyberspace. Thus, it is the policy of the United States to use all instruments of national power, including the innovative capabilities of the private sector, to combat cybercrime,” it says.
The NSPM calls for the establishment of a program within the Homeland Security Task Force’s National Coordination Center (NCC) that would enlist vetted U.S. companies to engage in cyber attacks and cyber surveillance against overseas transnational criminal organizations (TCOs).
“By partnering with vetted United States companies subject to the direction and oversight of the Federal Government, we will enhance our ability to counter TCO threats and combat transnational cybercrime, fraud, and other predatory schemes against American citizens,” it says.
Companies selected for the program would need to have “appropriate levels of technical proficiency, proven performance of cyber operations, facility security, personnel vetting, competence, reliability, and other factors,” the NSPM says.
The program’s eligibility criteria would have to “enable participation by both large companies, which provide critical capacity, and smaller, more agile companies, which may be better suited for specialized or discrete tasks,” it says. Participants would have to post a $1 million bond that would be forfeited if they strayed from the program’s requirement.
Participating companies would be assigned to conduct, under government supervision, “cyber effects” operations that result in “the manipulation, disruption, denial, degradation, or destruction of information systems, networks, physical or virtual infrastructure controlled by information systems, or information resident thereon,” according to the NSPM.
They would also conduct “cyber surveillance” operations by infiltrating infrastructure operated by TCOs “for the primary purpose of collecting information or intelligence,” the NSPM says.
Participating companies would have to immediately halt any operation that causes a “critical outcome,” defined as an action that would “result in the loss of life or serious injury” or “rise to the level of use of force or armed attack under international law,” it adds.
The program would be overseen by the departments of Justice and Homeland Security, the White House said in a fact sheet.
“The NSPM directs the Program’s Executive Directors and the Homeland Security Council to create rigorous procedures for the review and conduct of these limited cyber operations at the direction of the U.S. Government, ensuring strict compliance with the U.S. Constitution and laws, as well as applicable international agreements,” the fact sheet says.
The program builds on the “Cyber Strategy for America” released by the Trump administration in March, which sought to “unleash the private sector by creating incentives to identify and disrupt adversary networks.” That phrase raised the prospect that the administration might allow private-sector “hacking back,” although White House National Cyber Director Sean Cairncross quickly dispelled that notion.
“That’s not what we’re talking about,” Mr. Cairncross said in the days following the strategy’s release. The strategy instead seeks to enlist companies to “illuminate the battlefield,” he explained (CPR, March 17).
The new NSPM also builds on an executive order signed by the president in March that targets TCOs (CPR, March 9).
The NSPM insists that all private-sector cyber operations will be conducted “in accordance with the Constitution and all other applicable laws and international obligations of the United States,” including the main U.S. antihacking law, the Computer Fraud and Abuse Act (CFAA).
The CFAA, however, criminalizes the types of activities anticipated by the NSPM and also allows organizations to file lawsuits against individuals and entities that breach their networks without permission.
The CFAA has long dissuaded U.S. companies from engaging in even minor intrusions into third-party networks, and U.S. policy-makers have warned in the past about the collateral damage that could result from misdirected cyber attacks on foreign entities.
But lawmakers in recent years have expressed interest in allowing private-sector hacking back, given the scale of cyber crime and the capabilities of Internet infrastructure providers such as Microsoft Corp. and Google LLC.
Most recently, Sen. Mike Lee (R., Utah) and Rep. Tim Burchett (R., Tenn.) introduced bicameral legislation, the Cyber Letters of Marque and Reprisal Act, which would authorize the president to grant letters of marque to private-sector hackers, permitting them “to conduct limited offensive cyber operations.” That legislation cites a provision of the Constitution that empowers Congress to “declare War, grant Letters of Marque and Reprisal, and make Rules concerning Captures on Land and Water” (CPR, July 15).
MainStory: TopStory FederalLegislation DataSecurity