The U.S. Just Authorized Private Companies to Hack Back on Its Behalf

On August 12, the White House released a memorandum creating a formal program for vetted private US-based companies to conduct offensive cyber operations against foreign targets. This is something most people have never heard of, and is genuinely new. These operations will be conducted under the umbrella of federal government supervision. [1] One cybersecurity veteran who used to run incident response training for DHS called it “privateering for the digital age.” [2] This comparison is hard to argue with, and something worth pondering.

What Does the Memo Actually Authorize?

The memo, titled “Expanding Capabilities to Combat Transnational Cyber-Enabled Crime,” is a continuation of a March 2026 EO that sets up a formal program run through the National Coordination Center. [1]

How it Works:

“Participating Companies” are private firms that are both US based and have undergone a vetting process. They can be authorized to conduct two categories of operations against Cyber-Enabled Transnational Criminal Organizations (CE-TCOs). The first is Cyber Surveillance Operations. This is defined as unauthorized access for intelligence collection, staying undetected. The second is Cyber Effects Operations. This is the manipulation, disruption, degradation, or destruction of an adversary’s systems. [1]

Every operation requires sign-off by two Program Executive Directors. One from the Department of Justice, one from the Department of Homeland Security. Companies must sign contracts, undergo vetting for technical proficiency, and post a minimum $1 million bond or escrow, which is forfeitable for non-compliance. Program Directors are unable to approve operations resulting in “Critical Outcomes.” This is defined as anything that could cause loss of life, serious injury, or would rise to the level of “use of force or armed attack” under international law. [1]

Companies must also report to the government if they accidentally attack a US person, US-based system, or discover an imminent attack on US critical infrastructure. [1]

The memo explicitly states that the target CE-TCOs are criminal organizations, not foreign militaries or intelligence services. Moreover, they are to not be “an institutional part of a foreign government.” [1] While that is all well and good, the line between state-tolerated and state-directed hacking groups is anything but clear.

Who is Eligible?

The memo states eligibility should allow “both large companies, which provide critical capacity, and smaller, more agile companies, which may be better suited for specialized or discrete tasks.” The actual vetting criteria has yet to be published, but these are due within 60 days of publication. Meaning, we can expect the rules of engagement to be released sometime around mid-October 2026. [1]

One cybersecurity firm founder put it bluntly: “I expect every Israeli cyber startup to jump at the chance.” [2] This tracks, as Israel’s cyber industry has an unusually large presence among offensive-security firms. This is a reminder that “US-based companies” does not mean that the talent pool is strictly secluded to the US.

Does This Mean the US Needs a More Structured Cyber Force?

We wrote previously about the debate over standing up a dedicated Cyber Force branch of the military. While that debate has yet to go anywhere, this memo cuts it in a different way entirely. It suggests two very different diagnoses for the same problem.

The memo’s own stated rationale is that “American businesses’ innovative capabilities have historically been underutilized” and that private-sector “scale, speed, and capacity secure a critical offensive cyber advantage.” [1] Essentially, this is the government admitting that it can’t generate enough in-house talent to keep pace. With AI-assisted cyberattacks increasing by 89% in 2025, that gap is only widening. [2] If the government genuinely can’t keep up, that is yet another strong argument for a unified Cyber Force built specifically around cyber as its primary mission, rather than an additional duty split across four services.

The government has consistently chosen to buy capabilities from the private-sector rather than build it in-house. This is true of drones, space, and now offensive cyber. A large part of why is that government cyber salaries can’t compete with private-sector pay, especially anywhere AI and cyber overlap. Unlike China’s cyber apparatus running through centralized state ministries and Russia’s through the GRU and SVR, the US seems to prefer leaning on formally deputized private-sector operators. Whether this is a weakness or asymmetric advantage deriving from market-advantage models is still an unresolved argument. Both may be true at once.

What’s Next?

The memo gives Program Executive Directors 60 days to establish detailed SOPs. An annual report is required starting 180 days out. The real test will be seeing which companies are accepted, how tightly the DOJ and DHS enforce the “no Critical Outcomes” ceiling in practice, and whether or not a gray zone becomes reason for concern regarding the definition of CE-TCO. [1]