American Companies Can Now Hack Foreign Criminals

Washington has drawn a new line in cyberspace: for the first time, the federal government is building a supervised framework to authorize select U.S. companies to surveil and disrupt foreign cybercriminal organizations—folding private capabilities directly into offensive law enforcement operations abroad.

At a Glance

A presidential memorandum directs a federal program to deputize vetted U.S. companies for cyber surveillance and “effects” operations against foreign criminal gangs, under government control and oversight.
The National Coordination Center, working with Justice and Homeland Security, will license and manage participating firms within strict rules of engagement.
This is not free-for-all “hack-back”: operations require federal authorization, target foreign cyber-enabled transnational criminal organizations, and exclude U.S. persons and domestic systems.
The move formalizes what policy has long debated—how to leverage private cyber talent offensively without the legal and strategic downsides of unsanctioned self-help.

What the memorandum actually does

The presidential memorandum titled Expanding Capabilities to Combat Transnational Cyber-Enabled Crime directs the National Coordination Center (NCC) to “create, manage, and maintain a Program” authorizing “Participating Companies” to conduct two categories of activity: Cyber Surveillance Operations (intelligence collection in hostile networks) and Cyber Effects Operations (actions intended to disrupt, degrade, or otherwise impose costs), specifically against foreign cyber-enabled transnational criminal organizations (CE‑TCOs). The NCC’s mandate is explicit: participating firms act under federal control and oversight, not on their own recognizance. Major outlets and legal advisories describe a system in which Justice and Homeland Security set targets, approve operations case by case, and contract with cleared firms to execute technical work within defined boundaries.

This structure matters. For years, the Computer Fraud and Abuse Act (CFAA) and related statutes made clear that “hack-back” by private entities—no matter how aggrieved—was prohibited, while international law discouraged private self-help outside state action. The new program routes offensive measures through government authorization and supervision, aligning them with public authority rather than vigilante retaliation. It does not permit companies to strike back ad hoc; it creates a licensure-and-tasking model for missions against designated criminal networks abroad, with bright-line exclusions for U.S. persons and domestic infrastructure.

Why the government is doing this now

Transnational cybercrime has industrialized: ransomware cartels, access brokers, and fraud syndicates operate across borders with professional tooling and money laundering pipelines. Federal cyber operators and the FBI have improved disruption campaigns, but capacity is finite and adversaries recycle infrastructure quickly. The memo’s logic is straightforward—leverage private-sector speed, tools, and specialized access under a public mandate to increase the tempo and volume of law enforcement effects. Multiple reports frame this as a legal pathway that moves long-discussed public–private offensive collaboration from the shadows into a regulated lane, after years in which officials warned that private “active defense” risks misattribution and escalation.

Practically, authorized firms will contribute tradecraft that government may not natively scale—malware reverse engineering, botnet sinkholing, credentialed access remediation, payment interdiction support, and tailored takedown tooling. The supervised model can also accelerate the transition from intelligence to action: when a CE‑TCO racks up victims in days, a licensed contractor able to pivot within hours—rather than weeks of procurement—can matter operationally.

How the program is supposed to work

Public descriptions converge on a gated pipeline. First, the government designates a foreign criminal target set and mission objectives; second, a vetted company proposes a technical course of action; third, Justice and Homeland Security review legality, policy risk, and collateral impacts; finally, the NCC issues an authorization with rules of engagement, reporting duties, and post-operation auditing. Several accounts note financial and compliance guardrails, including escrow and forfeiture mechanisms, to concentrate participation among disciplined operators with skin in the game.

Two categories of operation are central. Cyber Surveillance Operations draw out network topology, malware infrastructure, and operator tradecraft inside a criminal ecosystem—intelligence that can underwrite arrests, sanctions, or subsequent disruptions. Cyber Effects Operations impose friction: seizing botnet controllers, null-routing malicious command domains, corrupting criminal tooling, or surgically disabling stolen-data pipelines. Oversight aims to ensure both are proportionate, discriminate, and legally bounded to non-U.S. targets.

What this is not: unsupervised hack-back

Commentary has emphasized a critical distinction: the memorandum does not authorize victims to retaliate autonomously. It builds a government-operated program where any offensive action requires prior sanction and remains a government operation in legal character, even if executed by a contractor. Federal briefings and legal analyses stress that domestic systems and U.S. persons remain off-limits; the target class is foreign criminal organizations, selected by the government, not by private grievance.

This is consistent with the CFAA’s long-standing bar on private intrusions into others’ computers and with Justice Department guidance that historically condemned hack-back on both legal and policy grounds. The program changes who can be tasked, not the baseline prohibitions on private self-help. Put simply: the government remains the sovereign actor; contractors are instruments, not vigilantes.

U.S. TO ALLOW PRIVATE FIRMS TO COMBAT FOREIGN CYBERCRIMINALS — On Aug 12 President Trump ordered the start of a program authorizing vetted US companies to conduct Cyber Surveillance Operations and Cyber Effects Operations against foreign Cyber-Enabled Transnational Criminal… https://t.co/ZwszdGw8qW pic.twitter.com/j0C4v289MF

— Urgent Intel (@urgentintel) August 22, 2026

The policy lineage and the recurring objections

For more than a decade, proposals to let companies “fight back” have appeared every few years, driven by asymmetry: defenders shoulder continuous losses while attackers externalize risk. Each wave runs into the same trio of objections—attribution, escalation, and accountability. Misidentification can burn innocents; overbroad actions can provoke diplomatic incidents; and unclear lines of authority make liability and oversight knotty. The new framework attempts to absorb those risks by consolidating targeting, legal review, and after‑action accountability inside the executive branch, with contractors as deputized agents rather than free actors.

International law scholarship has also traced the boundaries: while customary law offers little explicit guidance on private hack-back, it strongly prefers state-controlled measures; domestically, the CFAA is determinative. By embedding private operators within a state-sanctioned program, the memorandum squares that circle—active measures occur as acts of state, not private reprisal.

Implications: capability, deterrence, and the risk ledger

If implemented with rigor, this model could expand the United States’ ability to degrade criminal infrastructure persistently—reducing dwell time for ransomware crews, shrinking botnets, and increasing the cost of operating at scale. It may also create a clearer on‑ramp for companies that already support government cyber missions to contribute effects, not just intelligence, under uniform compliance terms.

The risk ledger remains nontrivial. Even state-directed actions can cascade: criminal infrastructure often sits in shared hosting; effects operations that are too blunt can impose collateral damage. Cross-border legal exposure for individual operators—detentions or extrajudicial harassment by hostile states—demands travel discipline and government protections. Program credibility will hinge on careful target development, conservative tradecraft, and visible accountability when things go wrong. But as a structural answer to the stalemate between mounting victimization and prohibited private self-help, the supervised-operations model is a consequential step—and, rightly managed, a defensible one.

What to watch as the program matures

Three markers will tell you whether this becomes a durable pillar of U.S. cyber enforcement. First, the quality of the authorization process: does the government consistently vet proportionate, well-attributed actions, or does speed erode discipline? Second, integration with traditional tools—indictments, sanctions, infrastructure seizures—so effects operations translate into lasting disruption rather than whack‑a‑mole. Third, transparency and oversight: periodic public reporting, even at a high level, will help sustain legitimacy without compromising tradecraft. If those elements hold, the United States will have built something long theorized but never operationalized at scale: a lawful, supervised channel for private talent to help take foreign cybercriminals off the field.