White House Authorizes Private Firms to Launch Offensive Cyberattacks

The Trump administration has issued a presidential memorandum that, for the first time, permits vetted private companies to execute offensive cyber operations against international criminal gangs and hackers, according to TechCrunch.

Under the new policy, participating firms may engage in surveillance—including the use of spyware for intelligence collection—and launch disruptive attacks intended to destroy the systems or data of criminals. This represents a seismic shift from previous U.S. government positions and federal hacking laws that prohibited private sector companies from conducting such operations without court approval.

To participate, companies must deposit $1 million into an escrow account, which is forfeited if the government finds the firm violated operational rules. All operations require sign-offs from the Justice Department and Homeland Security and must be conducted under federal supervision. The memorandum specifically directs the government to create procedures ensuring no operations target U.S.-based systems or Americans.

The policy arrives as the U.S. faces increasing threats from autonomous AI-driven attacks and Iranian government-backed hackers targeting water infrastructure in states such as Georgia, Michigan, and Minnesota. TechCrunch reports that federal cybersecurity staff have faced widespread cuts and layoffs since the start of the administration in January 2025.

Critics warned that the program could trigger diplomatic crises. Jake Williams, vice president of research and development at Hunter Strategy, told TechCrunch that Americans working for these firms could be classified as non-uniformed combatants by foreign governments, potentially leading to indictments or custody when traveling overseas. While the memorandum prohibits "hacking back," Williams described the policy as "half-baked" and suggested it provides cover for foreign governments to make accusations against U.S. citizens.