White House Authorizes Private Hacking of Cybercriminals, At Own Legal Risk

Trump Administration Authorizes Private Sector in Offensive Cyber Operations Against Criminal Networks

President Donald Trump signed a memorandum on Tuesday directing federal agencies to engage vetted U.S. companies in offensive cyber operations targeting foreign criminal networks. The National Security Presidential Memorandum, dated August 12, establishes a new program within the National Coordination Center of the Homeland Security Task Force.

The White House stated in the order’s purpose section that the memorandum “expands the fight against TCO-perpetrated cybercrime by incorporating the ingenuity of the private sector,” referring to transnational criminal organizations.

“By partnering with vetted United States companies subject to the direction and oversight of the Federal Government, we will enhance our ability to counter TCO threats and combat transnational cybercrime, fraud, and other predatory schemes against American citizens,” the statement read.

The program will be overseen by two executive directors, one each from the Department of Justice and the Department of Homeland Security. Private firms contracting with either agency will be able to propose and execute operations aimed at accessing, surveilling, disrupting, or destroying systems linked to these foreign-based networks.

Under the program’s framework, a company must first apply and successfully navigate a vetting process. They are also required to post a bond or escrow of at least $1 million, which would be forfeited if the company violates the program’s rules. These firms would then gather threat intelligence from other businesses or state and local agencies before submitting operational proposals to the National Coordination Center at Homeland Security.

Crucially, no action can be taken until the program’s executive directors review the proposal and provide written approval and direction. The government retains operational control throughout, with companies only authorized to execute actions upon explicit government instruction.

The memorandum authorizes “Cyber Surveillance Operations,” which include accessing systems without the owner’s permission or exceeding authorized access. It also permits broader offensive actions against networks involved in ransomware, phishing, financial fraud, and sextortion schemes. Operations expected to cause “Critical Outcomes” are prohibited. Any operation that might impact a U.S. person or a U.S.-based system must be immediately halted, with minimization procedures enacted.

The policy of the United States, as outlined in the memorandum, is to “use all instruments of national power, including the innovative capabilities of the private sector, to combat cybercrime.” This initiative is justified by the scale of the threat.

For instance, crypto scams alone are estimated to have cost Americans $80.7 billion in 2025. North Korean hackers have developed increasingly sophisticated methods for laundering stolen cryptocurrency, and the government has already seized over $25 million in crypto linked to investment and romance scams. This new program aims to scale up efforts to combat such activities by leveraging private sector capabilities.

The specific targeting rules for the program are detailed in a classified annex, meaning public details on the guardrails are limited. The memorandum mandates that companies have 60 days before implementation guidance is due.