NEWS
President Donald Trump has directed the federal government to create a program allowing vetted American companies to conduct supervised cyber-surveillance and cyber-disruption operations against foreign criminal organizations that target Americans.
The August 12 memorandum represents a significant change in the government’s approach to ransomware, online fraud and transnational cybercrime. It seeks to use private-sector speed and technical talent while keeping operations under federal authorization. Supporters see a practical way to hit criminal infrastructure. Critics warn that attribution errors, weak oversight or collateral damage could escalate conflicts across borders.
What the new program would do
The memorandum directs the government to establish a framework for participating companies to operate against designated cyber-enabled transnational criminal organizations. Targets may include foreign groups involved in ransomware, phishing, financial fraud, sextortion and impersonation schemes aimed at U.S. victims.
This is not a general license for companies or individuals to “hack back” whenever they are attacked. Participants must be vetted, operations must receive federal approval and the activity remains subject to American law and government direction. The program is designed for organizations that are not institutional parts of a foreign government or wholly controlled by one.
The policy builds on a March executive order and national cyber strategy that called for a more aggressive campaign against fraud networks. It also reflects a persistent reality: private cybersecurity firms often see malicious infrastructure, stolen data and attack patterns before government agencies do.
The case for using private expertise
Cybercriminals move quickly. They rent servers, shift domains, launder cryptocurrency and rebuild after a takedown. Federal investigations must coordinate legal process, intelligence and diplomacy, sometimes across several countries. A qualified private firm may be able to identify infrastructure or disrupt a network faster than a traditional government procurement cycle allows.
Government-supervised contractors already support defense and intelligence missions in many technical fields. Advocates argue that offensive cyber work can use the same model: clearly defined targets, written rules, operational review and consequences for violations.
There is also a deterrence argument. Criminal groups may be less willing to target Americans if they believe their servers, wallets and operational data can be disabled or exposed rather than merely investigated months later.
The risks are real
Cyber attribution is difficult. A server used by criminals may also host innocent customers, sit in an allied country or have been compromised without its owner’s knowledge. Disrupting the wrong system could destroy evidence, harm third parties or interfere with a separate U.S. intelligence operation.
Private incentives create another challenge. A contractor is paid to act, while government officials must consider diplomacy, proportionality and long-term security. Strong approval standards are necessary to prevent a race toward more dramatic operations.
Experts also disagree about accountability. The memorandum calls for federal oversight, but public reporting may be limited because operational details are classified or sensitive. Lawfare analysts who broadly support the concept have argued for tighter rules on who may nominate targets and stronger reporting to prevent mission creep.
International law adds complexity. An operation that disables infrastructure in another country can trigger diplomatic objections even when the target is a criminal network. The United States will need a process for notifying allies, resolving mistakes and compensating innocent parties where appropriate.
Guardrails Congress should demand
Congress should require a clear target standard, written approval for every operation and independent review after any significant incident. Reports should disclose aggregate numbers of operations, targets, disruptions, civilian effects and rule violations without revealing tactics that would help criminals.
Participating companies should carry meaningful financial responsibility and should not receive immunity for reckless conduct. The government should also preserve evidence for prosecution whenever possible; disruption should complement criminal cases, sanctions and diplomacy rather than replace them.
Why This Matters
Americans lose billions of dollars to ransomware and online fraud, and many victims never recover their money. A strategy that only hardens defenses leaves overseas criminal networks free to regroup. The administration is right to examine how American technical power can impose costs on attackers.
But offensive cyber operations can create consequences beyond the intended target. The program will succeed only if it combines speed with constitutional accountability, careful attribution and transparent oversight.
What to watch
- The eligibility rules for participating companies and designated targets.
- The roles of the Justice Department, Homeland Security and intelligence agencies.
- Congressional hearings on legal authority and public reporting.
- The first confirmed disruption and any response from a foreign government.
