US will let vetted private firms launch offensive cyberattacks

The White House said Wednesday that it will for the first time allow vetted private companies to launch offensive cyber operations against international criminal gangs and hackers, according to a newly published presidential memorandum from the Trump administration. The policy marks a seismic shift from the government’s long-standing position: for years, federal computer hacking laws have broadly prohibited private companies from conducting cyberattacks or disruption operations without court-authorized approval, permitting them only to defend against incoming attacks, not launch or operate them.

Under the memorandum, participating companies could conduct surveillance — including using spyware to collect intelligence — as well as disruptive attacks aimed at destroying criminals’ data or systems, though the policy does not let companies retaliate against threats on their own initiative. Every operation would require sign-off from the Justice Department and the Department of Homeland Security before it can proceed, and would be conducted exclusively under federal government supervision. The memorandum also directs the federal government to create procedures preventing any operation from targeting Americans or U.S.-based systems.

Participating firms must deposit $1 million in escrow, which is forfeited if the government finds a company isn’t complying with the program’s rules, and must notify the government if they discover an imminent cyberattack against critical U.S. infrastructure such as power grids or water providers. The government said it will issue guidance on program requirements within the next two months, and that companies of all sizes — including smaller firms that might be better suited for specialized operations — could take part. The policy is still in its early days, and a White House spokesperson did not say whether any companies are already participating.

Critics warn the policy risks diplomatic fallout if a foreign government accuses a U.S. company of attacking its systems. Jake Williams, vice president of research and development at cybersecurity firm Hunter Strategy, described the policy as poorly developed and warned that Americans involved in these operations “could easily be classified as non-uniformed combatants while traveling overseas” — and that a foreign government could level such an accusation whether or not it were true. The administration gave no reason for the shift beyond citing a growing threat to Americans and businesses; the move follows deep cuts to federal cybersecurity staff since the second Trump administration began in January 2025, and comes as officials have reportedly privately attributed a wave of attacks on water utilities in over a dozen U.S. states to Iranian government-backed hackers.

Why it matters

By shifting offensive cyber operations into private hands, Washington is testing a model that other governments may watch closely — and creating new legal and diplomatic exposure for the companies that take part.