Trump Signs Memo Allowing Private Firms to Conduct Cyber Operations Abroad

President Donald Trump signed a national security presidential memorandum that authorizes vetted private companies to conduct hacking operations against foreign criminal groups. The memorandum, titled "Expanding Capabilities to Combat Transnational Cyber-Enabled Crime," directs the Homeland Security Task Force’s National Coordination Center to establish the program. The initiative will be overseen by executive directors from the Justice Department and Homeland Security. Approved firms will be permitted to carry out cyber surveillance operations and cyber effects operations, which involve disrupting or destroying targeted systems.

Each participating company must enter into a contract with either the Justice Department or Homeland Security and will undergo a thorough screening process that assesses technical proficiency, facility security, and personnel background. Written approval is required before any operation can commence, and firms that violate their contractual terms will forfeit a bond of at least $1 million. The memorandum stipulates that program directors have 60 days to publish operational procedures, including the criteria for selecting targets.

Operations that could result in death or serious injury are explicitly prohibited, as are actions that would constitute a use of force under international law. If a firm exceeds its authorized parameters, it must cease operations immediately. The Computer Fraud and Abuse Act remains applicable to these operations.

Legalizing hack-back operations would require congressional approval, a process that has previously failed. Attempts to amend the statute to provide companies with an affirmative defense for retaliatory actions have not progressed to a vote.

The White House has estimated that consumer losses due to cyber-enabled crime reached $20.8 billion in 2025, with 73% of U.S. adults experiencing online scams or attacks. This memorandum extends Executive Order 14390, which Trump signed on March 6, aimed at combating cybercrime and fraud.

Experts have expressed mixed reactions to the program. Jason Kikta, a former U.S. Cyber Command official, described it as a "perpetual motion machine for billable threats." Ben Bernstein from Huntress Labs highlighted the challenges of accurately targeting cybercriminals, noting that attacks often originate from compromised infrastructure rather than identifiable servers. He warned that retaliatory actions could inadvertently impact innocent parties.

Conversely, Huntress co-founder Kyle Hanslovan supports the initiative, emphasizing the necessity of collaboration between public and private sectors to combat organized cybercrime. He also raised concerns about the potential risks of private actions disrupting government operations.

Will Barker, a cybersecurity advisor at Huntress, pointed out that the 60-day guidance period will be crucial in determining the program's effectiveness and the types of companies that will be involved. He anticipates that Congress will scrutinize the implications of allowing private firms to disrupt foreign systems, given the constitutional significance of such actions.

As of now, no specific companies have been named as participants in this program.