The United States government is preparing to let private cybersecurity companies move from simply defending networks to actively hacking the hackers. A new presidential memorandum, reported by TechCrunch, establishes a federal program under which vetted American companies can conduct offensive cyber operations against foreign cyber-enabled criminal organizations. The goal is to fight back against ransomware gangs, online fraudsters, and other criminals who target American citizens and businesses.

For years, the official position of the U.S. government was clear: private companies could build firewalls, monitor networks, and respond to intrusions, but they were not allowed to launch their own attacks against adversaries. That line is now being crossed. Under the new plan, private firms with proper clearance and federal supervision may be able to hack into criminal infrastructure, disrupt operations, and even destroy data.

What the new program allows

The memorandum, issued by the Trump administration, outlines two main categories of operations: surveillance and disruptive actions. Surveillance operations would allow companies to secretly access computer systems without the owner's permission in order to gather intelligence about criminal groups. Disruptive operations go further, enabling firms to manipulate, disrupt, degrade, or destroy computer systems and data belonging to foreign criminal organizations.

These are not blanket authorizations. Every operation will require written approval from the program directors at the Department of Justice (DOJ) and the Department of Homeland Security (DHS). The companies must act under federal supervision, and they could be required to put up at least $1 million in a bond or escrow account. This money could be forfeited if the company violates the rules or exceeds the scope of its approval.

The program is designed to target foreign criminal groups, not foreign governments. The memorandum includes guardrails to prevent operations from accidentally hitting U.S. persons or systems. If that happens, the company must immediately stop the operation and report the incident to federal officials.

A major shift in U.S. cyber policy

The move represents a fundamental change in how the U.S. government views the role of private companies in cybersecurity. For decades, the prevailing wisdom was that private firms should be the first line of defense, but offensive actions were the sole province of government agencies like the National Security Agency (NSA) and U.S. Cyber Command. The private sector was seen as too unpredictable and too risk-averse to be trusted with offensive tools.

That thinking has changed in recent years as ransomware attacks have skyrocketed. Criminal groups, many operating from safe havens in Russia and other countries, have extorted billions of dollars from American hospitals, schools, and critical infrastructure. The colonial pipeline attack in 2021 and the ransomware assault on JBS Foods showed how vulnerable the U.S. supply chain is to these groups. A growing chorus of security experts has argued that defensive measures alone are not enough to stop them.

The new policy aims to use the private sector's expertise and agility to go on the attack. Many cybersecurity companies already have deep knowledge of criminal infrastructure because they track it for defensive purposes. They know how ransomware gangs move, where they store stolen data, and how they launder money. Allowing them to strike back could disrupt criminal operations in ways that traditional law enforcement cannot.

The role of federal oversight

The memorandum makes clear that the government will call the shots. Companies cannot choose their targets or launch operations on their own. They must submit detailed proposals, and the program directors at DOJ and DHS will decide whether to approve them. The firms will operate under federal supervision, meaning government officials will monitor their actions in real time and provide guidance if needed.

This oversight is intended to address the legal and diplomatic risks that come with private companies conducting offensive cyber operations. International law on cyberattacks is still murky, and there are concerns that actions taken by private firms could be attributed to the U.S. government, leading to retaliation. By requiring federal approval, the administration can argue that the operations are state-sanctioned and therefore legal under domestic law.

The $1 million escrow requirement is another layer of accountability. If a company goes rogue, causes unintended damage, or violates the terms of its approval, the money can be seized. This financial stake helps ensure that companies take the responsibility seriously. However, the requirement could also limit participation to larger firms that can afford to tie up a million dollars in escrow.

Industry reaction and concerns

The announcement has drawn mixed reactions from the cybersecurity community. Some experts see the program as a necessary and pragmatic response to the growing threat of cybercrime. They argue that the government cannot do it all alone and that private companies have unique capabilities that should be used.

Others are more skeptical. Jake Williams, a well-known cybersecurity veteran, told TechCrunch that the plan was "half-baked." He warned that American individuals involved in these operations could face legal trouble or be accused of breaking foreign laws when traveling overseas. Private operators are not protected by the same legal immunities as government employees, and foreign countries might see them as vigilantes or spies.

There are also practical concerns. The rulebook is not yet complete – officials have been given 60 days to establish operating procedures. That means the program is still in its early stages, and it is unclear how many companies will be willing to participate. The liability issues are significant, and the escrow requirement adds another barrier.

Historical context

The idea of recruiting private companies for offensive cyber operations is not entirely new. The U.S. military and intelligence agencies have long used private contractors to develop weapons and conduct cyber espionage activities. But this program is different because it focuses on cybercrime rather than state actors, and it explicitly allows companies to take offensive action against criminal groups.

In past years, the U.S. government has used the FBI to dismantle ransomware infrastructure, such as the 2021 operation that gained access to the infrastructure of the REvil group. But those operations are often slow and limited by jurisdictional boundaries. A program that leverages private companies could in theory be faster and more effective, but it also raises the risk of unintended consequences, such as collateral damage to innocent parties or escalating tensions with other countries.

What the future holds

As the 60-day planning window unfolds, the cybersecurity industry will be watching closely to see the details. Questions remain about how companies will be vetted, what kind of training they will require, and how the government will ensure compliance. It is also unclear whether the program will survive future administrations or be revised by Congress.

The shift in policy signals a new era in the fight against cybercrime. If successful, it could lead to a more aggressive stance against ransomware groups and other online criminals. If it fails, it could create a nightmare of legal and diplomatic disputes, or even empower private companies with too much authority over who gets hacked.

For now, the message from Washington is clear: the private sector is being invited to fight fire with fire, and the government is ready to supervise the flames.

Source: Android Authority News