On August 13, TechCrunch reported a newly published U.S. presidential memorandum that, for the first time, opens a path for vetted private companies to conduct offensive cyber operations against international criminal groups—under federal supervision. The White House framed the shift as using private-sector capability against ransomware, financial scams, and related cyber-enabled crime. Participating firms could be authorized for intelligence collection (including spyware-style surveillance in program bounds) and disruptive actions aimed at criminal infrastructure—not open-ended “hack back” against any attacker. Guardrails described in reporting include DOJ and DHS sign-off before operations, rules meant to avoid targeting Americans or U.S. systems, government supervision, a $1 million escrow deposit forfeitable for non-compliance, and a duty to report imminent threats to critical infrastructure. Detailed participation rules are expected within about two months. Critics warn of diplomatic blowback and legal risk for private operators abroad. For security vendors and enterprise CISOs, this is a major policy fork: offense leaves the exclusive government lane and enters a regulated private partnership model.
0