Private Cyber Operations Are Now Part of U.S. Power

I. Five Months From “Not Hack Back” to a Program

In March, as the administration rolled out its new cyber strategy, a senior White House official stood in front of reporters and closed a door. Asked whether the private sector would be authorized to strike back at hackers, the White House’s March position on private offensive campaigns was direct: “That does not mean hack back, that does not mean letters of marque. We’re not interested in fighting pirates with pirates.” The National Cyber Director made the same point the same week, at the McCrary Cyber Summit, telling industry the administration wanted their visibility into threats, not their offense.

Five months later, a presidential memorandum has built the thing that was ruled out. It does not hand companies a general license to retaliate. Instead, it creates a federal program, run by the Department of Justice and the Department of Homeland Security, through which vetted companies can be authorized, case by case, to conduct private cyber operations against qualifying foreign criminal infrastructure. The distance between March and August is not a contradiction so much as a narrowing: from ruling out private offense entirely, to building a specific, supervised lane for it.

II. What Private Cyber Operations Now Mean

The August 12 presidential memorandum defines two categories of activity. A Cyber Surveillance Operation is intelligence collection: accessing a target’s systems without authorization, or beyond authorization, to gather information, with intent to stay undetected. The program’s definition of cyber effects operations goes further: action that manipulates, disrupts, denies, degrades or destroys systems, infrastructure or the information inside them.

Both categories describe real technical reach into someone else’s systems. Neither describes a company acting on its own judgment. Every operation in either category has to move through the same federal gate before a participating company may act, and the memorandum is careful to say who that gate excludes: only foreign groups that meet the program’s definition of a cyber-enabled transnational criminal organization qualify as targets. A group presumed to be acting on behalf of a foreign government falls outside that definition entirely. This is a program built around criminal networks, not state adversaries, and the distinction is load-bearing, not incidental.

III. A Private Company, Acting With Government Authority

To take part, a company has to be vetted and under contract with DOJ or DHS, meeting standards the memorandum leaves to those agencies to set: technical proficiency, personnel security, a track record of reliable performance. Every operations package a company proposes still needs coordinated, written approval from the program’s two executive directors before any action happens.

That structure answers the question that matters most here. The capability is private. The authority is public. Public accountability begins with the government that authorizes and directs the operation, while the participating company remains bound by its contract, the program’s procedures and applicable law. The contractor model is familiar in other federal domains; what is new here is the operational lane being built for private cyber capability.

The memorandum also draws a line companies will need to hold. Operating under the program does not replace a company’s ordinary right to defend its own networks; that authority already existed and continues separately. What the program adds is narrower: a legal channel into systems a company never controlled, opened only with federal direction and closed the moment that direction ends.

IV. The Million-Dollar Bond Is Not the Main Safeguard

The most quotable detail in the memorandum is a financial one: DOJ and DHS can require a participating company to post a bond or hold funds in escrow, at least one million dollars, forfeited if the company breaks its contract. It is a real requirement, but framing it as the safeguard undersells what the document actually builds around it.

The heavier machinery is procedural. Operating rules, due within sixty days, have to cover target validation, legal deconfliction across agencies, protections for U.S. persons and domestic systems, a stop-and-report duty the moment an operation drifts outside its approved scope, and annual review of whether a company stays eligible to participate at all. For private cyber operations, those procedures matter more than the headline bond: they are what are supposed to keep an operation from becoming a mistake with consequences.

Worth noting precisely: the memorandum does not require every participating company to post that bond automatically. It authorizes DOJ and DHS to mandate one as a condition of a company’s specific contractual agreement. The number is real, but it is a contractual lever, not a universal entry fee — and it is smaller, as a governance tool, than the reporting and review structure sitting around it.

V. The Internet Does Not Respect Clean Target Boundaries

Lawfare’s analysis of private cyber offense, published in May, points to a structural problem that predates this memorandum: criminal infrastructure rarely sits by itself. Attackers route through rented servers, hijacked accounts and shared cloud environments that also carry legitimate traffic that has nothing to do with the crime.

That is precisely why the memorandum requires operating procedures to address unintentional targeting of U.S. persons or domestic systems, with a mandatory stop-and-notify step if it happens. The requirement exists because the risk is real, not theoretical. Confident attribution, in infrastructure this tangled, is work, not a formality.

VI. Disruption Week Shows What Changed

The clearest before-and-after sits two months earlier. In June, the Justice Department’s June Disruption Week shared intelligence with companies including Apple, Coinbase, Google, Meta and Microsoft. Those companies voluntarily disrupted scam accounts and infrastructure on their own platforms, acting under their own terms of service, freezing several million dollars in fraud-linked crypto and cutting off more than a million accounts.

That was real cooperation, and it stayed inside a boundary: companies acting on systems they controlled. The new program contemplates something the June operation did not: authorized entry into a target’s own external systems, under a federal legal umbrella built specifically for that purpose. The boundary that held in June is the one August moves.

VII. The Rules Are Still Being Written

Program executive directors have sixty days to finalize the operating procedures this entire structure depends on, and a status report is due to the White House within a hundred and eighty days, and annually after that. Almost everything that will determine whether this program operates within the safeguards the memorandum describes sits inside procedures not yet public: how eligibility gets decided, how a target gets adjudicated, what triggers a stop, what becomes public reporting and what stays classified.

The memorandum itself sets a floor worth noting. Program directors cannot approve an operation expected to cause loss of life or serious injury, or to rise to the level of a use of force or armed attack under international law. That ceiling exists on paper now. Whether it holds in practice is the next chapter of this story, and it will be a slower one than this week’s headline.

For operators watching this space, the sixty-day window is the thing to calendar. It is where private cyber operations move from memorandum language into an operating system of checks — or reveal where those checks are thinner than the announcement suggested.

The Operator’s Bookshelf

KMOB1003 Reads

Nexus: A Brief History of Information Networks from the Stone Age to AI

Yuval Noah Harari

A broad history of how information networks coordinate institutions and concentrate authority — useful context for a story about private technical systems becoming instruments of public power.

Read Nexus →

Attack from Within: How Disinformation Is Sabotaging America

Barbara McQuade

McQuade’s examination of institutional trust, information manipulation and democratic vulnerability widens the question beyond cybersecurity: power depends not only on capability, but on the rules and legitimacy governing its use.

Read Attack From Within →

As an Amazon Associate, KMOB1003 may earn from qualifying purchases.

Disclosure: KMOB1003 may earn a commission from qualifying purchases through select partner links. Editorial coverage is produced independently.