Trump opens US cyber operations to private companies as experts warn of escalation
Vetted American companies could be authorised to infiltrate and disrupt foreign criminal networks under a new government-run programme. Cybersecurity experts warn that attribution errors, collateral damage and unclear legal protections could turn a cybercrime operation into an international crisis.
US President Donald Trump has ordered the creation of a programme allowing selected private companies to participate in offensive cyber operations against foreign criminal organisations.
The National Security Presidential Memorandum, signed on 12 August 2026, directs the Department of Justice and Department of Homeland Security to oversee operations designed to collect intelligence from, disrupt or dismantle infrastructure used by overseas cybercrime groups.
The policy represents a significant expansion of the private sector’s role in US cyber operations. It does not, however, give companies a general right to retaliate against hackers that attack them.
A business hit by ransomware would not be permitted to pursue its suspected attacker independently. Participating companies must be contracted and vetted by the government, while every proposed operation requires written approval and direction from programme executives appointed by the Justice Department and Homeland Security. Any resulting action must be conducted on behalf of and under the supervision of the federal government.
Companies could covertly enter criminal systems
The memorandum establishes two categories of authorised activity.
A cyber surveillance operation may involve covertly accessing a computer system without its owner’s permission, or exceeding authorised access, to collect information or intelligence while attempting to remain undetected.
A cyber effects operation can go further. The memorandum defines these operations as actions that manipulate, disrupt, deny, degrade or destroy computer systems, networks, data and physical or virtual infrastructure controlled by information systems.
The definition potentially covers actions ranging from accessing a ransomware gang’s internal communications to disabling servers, deleting information or interrupting infrastructure used to conduct fraud and cyberattacks.
The White House argues that private companies possess technical capabilities, visibility and speed that have not been used to their full potential against international cybercrime. It says the programme will help address ransomware, phishing, financial fraud, sextortion and impersonation schemes targeting Americans. The administration reported that US consumers lost more than $20.8 billion to cyber-enabled crime in 2025.
Australian executive warns of ‘very dangerous precedent’
Noel Allnutt, co-founder and chief executive of Sydney-based cybersecurity company Sekuro, warned that involving private companies in offensive operations could create a “very dangerous precedent”.
Allnutt told The Australian that it is often difficult to determine who is ultimately behind a cyberattack, particularly when criminal groups have relationships with foreign governments.
He said a mistaken or incomplete attribution could result in a private company interfering with digital or physical infrastructure belonging to another country. In an extreme case, such an operation could be interpreted as an “act of war”.
Sekuro was acquired by Nasdaq-listed technology company Insight Enterprises in November 2025, although Allnutt remained identified as Sekuro’s chief executive and co-founder following the transaction.
Allnutt’s warning is an expert assessment rather than a finding that the new programme itself constitutes an act of war. The memorandum expressly recognises the international law threshold by defining operations likely to amount to a use of force or armed attack as producing a “Critical Outcome”.
The programme’s two executive directors cannot approve an operation likely to cause death, serious injury or reach the international law threshold for a use of force or armed attack. Participating companies must also alert the government if an authorised operation begins to create such a risk.
Those restrictions are intended to prevent the most severe consequences, but they do not eliminate the possibility of miscalculation, unintended disruption or retaliation below the threshold of armed conflict.
Attribution remains a central problem
The programme is supposed to target foreign cyber-enabled transnational criminal organisations, not foreign governments or groups wholly operating under state direction.
However, the memorandum says a group will be assumed not to be an institutional part of a foreign government, or wholly directed by one, unless clear intelligence establishes that connection.
That presumption is likely to receive close scrutiny because relationships between governments and cybercriminal groups are rarely transparent. States may tolerate criminals operating from their territory, provide them with limited assistance or use them as proxies while retaining plausible deniability.
Cybercriminals also frequently hide their activity behind infrastructure belonging to other victims. An attack may pass through compromised routers, cloud accounts, websites or business servers that have no deliberate connection to the perpetrators.
This means disabling infrastructure associated with an operation could affect an innocent organisation even when investigators have correctly identified the criminal group. Security experts have warned that compromised systems used as intermediaries may belong to ordinary businesses, healthcare providers or other unrelated owners.
The memorandum requires a company to stop an operation, minimise its effects and notify the government if it discovers that it has unintentionally targeted a US person, a system located in the United States or infrastructure controlled by a US person.
The public document does not describe an equivalent notification process for innocent foreign organisations whose systems may have been compromised and used by criminals.
More than a conventional cybercrime takedown
Technology companies already play a significant role in disrupting cybercrime, but their actions have generally relied on civil litigation, platform enforcement, domain suspensions and court-authorised seizures coordinated with law enforcement.
Microsoft, for example, has used civil proceedings to seize thousands of domains associated with malware and phishing operations. In May 2025, the US Justice Department seized domains used by the LummaC2 information-stealing malware while Microsoft pursued an independent civil action against approximately 2,300 related domains.
Google has similarly combined technical disruption with litigation against botnet and phishing operators. These actions have relied on courts, infrastructure providers and the company’s authority over its own services rather than giving private employees a general power to enter external systems without permission.
Trump’s new programme moves beyond that model. It contemplates covert access to foreign systems and operations capable of damaging or destroying digital infrastructure, provided those actions are approved and controlled by the government.
Who actually conducts the attack remains unclear
Despite the memorandum’s broad language, there is a drafting ambiguity over precisely what participating companies will be permitted to do.
Its definition of a participating company says accepted businesses will be authorised to conduct cyber operations under US government direction. Another section refers to operations conducted by personnel from the Justice Department and Homeland Security.
Lawyers from Mayer Brown said the forthcoming operating rules will need to clarify whether private companies directly execute operations or instead develop capabilities, identify targets and support actions carried out by government personnel. The distinction could have substantial consequences for legal liability, employee protection and the contracts governing each operation.
The memorandum requires the programme’s operating procedures to be established within 60 days. Those rules must address company eligibility, target identification, operational monitoring, inter-agency coordination, reporting and the handling of activity that exceeds an approved scope.
The procedures must also support both large companies with significant capacity and smaller businesses suited to specialist assignments. The government may require participating firms to maintain a bond or escrow worth at least $1 million, which could be forfeited for non-compliance.
No participating companies are identified in the White House’s public memorandum or accompanying fact sheet.
Questions over legal protection and retaliation
The public memorandum says operations must comply with the US Constitution, federal law and international obligations. It specifically refers to the Computer Fraud and Abuse Act, the principal US law prohibiting unauthorised access to protected computers.
The document does not create an explicit new statutory immunity for private companies. Instead, it frames their activity as part of lawful federal investigations, protective activity or intelligence operations conducted under government authority.
Legal and cybersecurity specialists have said the contracts between participating firms and the government will therefore be critical. Questions remain about indemnification, responsibility for collateral damage, employee exposure and what happens when an operation is lawful under US authority but potentially violates the law of the country where the targeted infrastructure is located.
Companies may also face retaliation from cybercriminals or foreign governments. Participation could make their employees, infrastructure and customers more attractive targets, while businesses that operate internationally may face questions about trust and neutrality.
Australian companies cannot simply hack back
The US approach contrasts with the position faced by private companies in Australia.
Australia’s Criminal Code includes offences covering unauthorised access to restricted data, unauthorised modification of data and the impairment of electronic communications. Unauthorised modification causing impairment and unauthorised impairment of communications can each carry penalties of up to 10 years in prison. The computer offences are also subject to extended geographical jurisdiction.
The fact that a system belongs to a suspected criminal does not automatically give an Australian business permission to access or damage it.
Australia does conduct disruptive operations against cybercriminals, but those activities are performed under government authority. The federal government’s “Hack the Hackers” initiative has brought together the Australian Federal Police and Australian Signals Directorate to identify and disrupt malicious actors.
The Australian Cyber Security Centre also distinguishes active cyber defence from hacking back, warning that the terms should not be treated as interchangeable.
Impact will depend on rules still being written
Trump’s memorandum could give US authorities access to highly specialised security talent and private threat intelligence that government agencies do not possess at the same scale.
It could also allow operations to move more quickly against criminal infrastructure that is frequently rebuilt after conventional seizures and arrests.
The effectiveness and safety of the programme will depend on details that have not yet been made public. Those include how targets are attributed, how companies are monitored, what evidence is required before an operation is approved, how foreign governments are consulted and who is responsible when an authorised action produces unintended effects.
Calling the proposal “hack back” risks suggesting that companies will be free to launch independent retaliation. The public memorandum instead describes a government-run contractor programme with formal approvals and federal supervision.
That distinction may be important under US law. It may offer less reassurance to a foreign government or innocent infrastructure owner affected by an operation that goes wrong.