President Donald Trump signed a national security memorandum on Wednesday that establishes a framework for private sector companies to participate in offensive hacking operations against transnational criminal organizations. The White House stated that the memo was a response to persistent fraud and other cyber-enabled campaigns perpetrated by these organizations, building on a fraud-focused executive order issued in March.
The memorandum outlines the creation of a federal coordination center, which will manage a program to authorize "Participating Companies" to conduct "Cyber Surveillance Operations" and "Cyber Effects Operations." These operations would target "foreign Cyber-Enabled Transnational Criminal Organizations (CE-TCOs)" and would be carried out under the control and oversight of the federal government, as part of lawful investigatory, protective, or intelligence operations by federal law enforcement.
To qualify, participating companies would need to enter into contracts with either the Department of Justice or the Department of Homeland Security and undergo a rigorous vetting process. The program also allows these companies to form commercial agreements with other private sector entities to share threat intelligence. Furthermore, agreements between participating companies and federal, state, and local governments would focus on identifying threats and proposing cyber operations to the coordination center.
The memo explicitly states that the program must adhere to existing laws, including the Computer Fraud and Abuse Act (CFAA), the primary federal anti-hacking statute. Prior proposals to involve the private sector in hacking operations had suggested amending the CFAA, but this memorandum does not. It also mandates oversight to assess companies' technical proficiency, ensures participation from both small and large companies, and requires regular reporting to federal officials.
The move represents a significant shift in U.S. cyber policy, according to some experts. While there has been a sentiment in conservative circles to issue "letters of marque" for private cyber firms, similar to those used for early U.S. sea privateers, there have also been deep concerns within the cybersecurity community about granting the private sector too much authority in offensive operations. Critics have previously warned that "hack-back" legislative proposals, which would legalize currently illegal actions, could set a dangerous precedent and lead to wider chaos in cyberspace.
One former Cyber Command official, Jason Kitka, criticized elements of the memorandum, describing it as a "perpetual motion machine for billable threats." Conversely, Josh Steinman, a co-founder of Galvanick and a former top White House cyber official during Trump's first term, expressed support for the development. Chris Wysopal, co-founder of Veracode and a cyber pioneer, characterized the memo as a "pretty big shift in US cyber policy" that, while notable, did not go as far as some other "hack-back" proposals.
