White House Opens Door to Private Cyber Operations Abroad

The Trump administration is developing a programme that could allow selected American companies to conduct offensive cyber operations against foreign criminal groups. The proposal would move private contractors beyond their familiar support role and, under government direction, permit them to access, monitor or disrupt targeted networks.

A presidential memorandum directs the Department of Justice and Department of Homeland Security to work out the programme's details. It does not repeal US anti-hacking laws, and businesses would not receive a general right to attack whoever they consider suspicious.

What the memorandum proposes

Participating companies would need a federal contract, pass rigorous vetting and place $1 million at risk if they failed to meet their obligations. Government agencies would select targets described as foreign cybercriminals.

The document contemplates operations that manipulate, disrupt, deny, degrade or destroy information systems. It also allows intelligence collection. That range covers activity far beyond defensive monitoring inside a client's own network.

The Justice and Homeland Security departments have two months to resolve major questions. The memorandum does not yet explain which legal authorities would protect contractors, how targets would be approved, what level of force would be permitted or how mistakes would be investigated.

Why supporters want private help

Ransomware groups, fraud networks and data thieves cost Americans billions of dollars each year. They attack companies, hospitals and public utilities, often operating from jurisdictions where US arrest warrants have little practical effect.

Supporters believe private security companies can move faster than government agencies and bring specialised talent. Smaller firms and venture-backed start-ups may also see an opportunity to win substantial federal contracts.

Private companies already cooperate with US authorities to dismantle infrastructure, analyse malware and recover information. The difference is control. They have generally provided expertise while government agencies retained responsibility for intrusive or destructive action.

The proposal resembles the historical idea of privateers authorised to act against an enemy, although the memorandum stops short of granting an open licence. Every operation would remain tied to a government contract and selected target.

Legal and technical risks are substantial

Cyber infrastructure does not respect clean national borders. A criminal server may share a data centre with hospitals, transport companies or innocent businesses. Disabling the wrong equipment could interrupt essential services and expose the contractor and government to liability.

Attribution is another problem. Criminal groups sometimes work with governments, rent infrastructure from third parties or deliberately plant misleading evidence. An operation aimed at a group believed to be independent could strike a state-linked actor and trigger retaliation.

Foreign domestic law also matters. A contract from Washington does not automatically make unauthorised access legal in the country where a server is located. Allies may object if American contractors conduct operations on their territory without consent.

Cybersecurity professionals interviewed by NPR also questioned whether private firms would be better at disruption than surveillance. Collecting intelligence may be more controlled, while destructive action can produce an unpredictable blast radius.

Offensive action does not replace defence

Even a successful operation against one ransomware group will not eliminate the conditions that allow attacks. Organisations still need secure backups, patched software, multifactor authentication, network segmentation and trained staff.

The recent targeting of dozens of Minnesota water systems illustrates why resilience remains central. Taking down an attacker after an incident cannot undo service disruption or leaked data.

The US private cyber operations plan could add a useful tool if authority, oversight and liability are defined narrowly. Without those limits, the government risks outsourcing decisions that carry diplomatic and public-safety consequences.

The next two months will show whether the memorandum becomes a controlled contracting framework or remains an ambitious statement with unresolved legal problems. The quality of target verification, independent review and public accountability will determine whether private participation strengthens security or creates a new source of risk.

This Novexa News report is based on the presidential memorandum and expert analysis reported by NPR.