Trump administration wants to allow companies to hack foreign cybercriminals

Private Sector Gets New Role in Global Cyber Defense Under Trump Administration

Ecorescuezone.com – The Trump administration has unveiled a policy initiative that could fundamentally reshape how American businesses participate in international cyber operations. A presidential memorandum released late Wednesday establishes a framework permitting select U.S. corporations to actively pursue foreign cybercriminals—a role historically reserved exclusively for government agencies.

This policy shift represents a significant evolution in America’s approach to digital security. While private companies have long supported government efforts through traditional contracting arrangements, the new memorandum opens doors for businesses to take on more direct offensive and intelligence-gathering missions against foreign entities designated as cybercriminals by federal authorities.

Legal Framework and Requirements

Current U.S. anti-hacking legislation generally prohibits both individuals and commercial entities from penetrating digital infrastructure, with limited exceptions primarily serving law enforcement purposes. The presidential memorandum does not amend these existing statutes. Instead, it requires all participating companies to maintain formal contracts with the federal government, creating a legal bridge between private sector capabilities and government authorization.

Companies entering this program must establish agreements with either the Department of Justice or the Department of Homeland Security. The memorandum outlines several concrete requirements: participating firms must undergo rigorous vetting procedures and set aside one million dollars as a financial guarantee that the government can collect if a company fails to meet its obligations.

Once approved, these corporations receive permission to access computer networks belonging to foreign organizations. The memorandum specifically authorizes actions that result in the manipulation, disruption, denial, degradation, or destruction of information systems operated by targeted entities.

Historical Context and Industry Response

The concept of private actors engaging in foreign cyber operations draws inspiration from sixteenth-century naval warfare practices. Since the Trump administration assumed office last year, two Republican members of Congress have introduced legislation proposing the creation of cyber “privateers”—a term referencing historical private vessels authorized by governments to attack enemy shipping. While the current memorandum does not grant private businesses the full authority envisioned by that legislative proposal, it has generated enthusiasm among supporters of the concept.

There’s a range of potential targets … like organized crime … people doing money laundering or other criminal activity, said Joshua Steinman, who served as senior director for cyber policy on the National Security Council during President Trump’s first term.

Steinman’s observations highlight the breadth of entities that could fall under this new program. The memorandum envisions targets extending beyond traditional state-sponsored hackers to include organized crime syndicates, money laundering operations, and various other criminal enterprises operating across borders.

Stacy O’Mara, chief policy officer at cybersecurity firm Armadin, expressed cautious optimism about the initiative. She indicated that the document places the industry in a “wait and see” position while numerous legal questions remain unresolved.

There are all these other components that are still outstanding, O’Mara said. Especially around the legal authorities and protections.

The memorandum allocates two months for the Department of Justice and Department of Homeland Security to address these outstanding questions. However, several critical elements remain undefined, including the specific vetting criteria, target selection processes, types of permissible disruptive attacks, and legal justifications for such operations.

Corporate Opportunities and Challenges

Private corporations have traditionally collaborated with federal authorities in cyber defense, but primarily in supportive contractor capacities rather than as primary actors conducting offensive operations. The new policy could attract diverse participants, from smaller enterprises and venture-backed startups to established companies seeking lucrative government contracts.

I’m sure a lot of these companies will see this as a potential opportunity to … improve their visibility or directly command resources from the government, said Arthur Tellis, a former Department of Defense staffer and current fellow at the Institute for Progress.

Tellis noted that participating companies would likely excel at surveillance activities compared to executing disruptive operations against criminal organizations. This distinction could influence which types of firms find the program most appealing and how they deploy their resources.

Critical Perspectives

Not all industry observers welcome the policy shift. Paul Rosenzweig, who leads a Washington, D.C. consulting firm and previously served as deputy assistant homeland security secretary for policy under President George W. Bush, offered a measured but skeptical assessment.

It’s not an incomparably bad idea, but it’s a bad idea, said Rosenzweig.

Rosenzweig identified numerous practical and legal complications that private actors would encounter when conducting cyber operations against foreign organizations. He emphasized that the memorandum fails to adequately address the complex web of domestic laws in host countries that could apply to American companies operating abroad.

Anything that our new cyber-enabled private sector actors do overseas will assuredly be against the domestic law of a host of countries, he noted, pointing to the incomplete nature of the current framework.

The memorandum’s limited explanation of how private businesses can assume roles traditionally performed by government agencies raises additional questions. Critics argue that without clearer guidelines, the policy could create confusion about jurisdictional authority and legal accountability when American companies conduct operations in foreign digital spaces.

As the implementation timeline progresses, the cybersecurity community will watch closely to see which companies volunteer for participation and how the government resolves the outstanding legal and procedural questions. The success of this initiative could determine whether private sector cyber operations become a permanent feature of America’s digital defense strategy or remain an experimental approach subject to revision or abandonment.