Trump Signs Memo Letting Private Companies Hack Foreign Cybercrime Gangs

President Trump signed a national security presidential memorandum late Wednesday that lets vetted private companies hack foreign cybercrime organizations, according to SiliconANGLE and The Record. The memo, titled "Expanding Capabilities to Combat Transnational Cyber-Enabled Crime," represents a shift in how America fights online criminals.

Companies that sign contracts with the Justice Department or Homeland Security can conduct "cyber surveillance operations" and "cyber effects operations" against transnational criminal organizations, or TCOs. The second category means disrupting or destroying a target's systems, per SiliconANGLE.

The White House built in guardrails. Companies need technical vetting, background checks, and facility security clearance. They must post a bond of at least $1 million, which they forfeit if they break the rules, according to SiliconANGLE. Every operation needs written sign-off from DOJ and DHS co-directors before it happens.

The memo also draws hard lines. No operations that could kill or seriously injure anyone. Nothing that counts as a "use of force" or "armed attack" under international law. If a company accidentally hits a U.S. person or system, they must stop immediately, according to Cybersecurity Dive. The Computer Fraud and Abuse Act, which bans unauthorized hacking, still applies to everyone.

The White House says Americans reported $20.8 billion in cyber-related losses in 2025, and 73% of U.S. adults have been hit by some kind of online scam or attack, according to SiliconANGLE. This builds on Trump's March 6 executive order, "Combating Cybercrime, Fraud, and Predatory Schemes Against American Citizens," which told federal agencies to get more aggressive.

The Department of Justice and Department of Homeland Security have 60 days to write the actual operating procedures, including how they'll pick targets and avoid stepping on each other's operations or the military's, according to Cybersecurity Dive.

It's not actually new

Robert Graham, CEO of Errata Security, raised concerns about the concept. "This has been discussed under the name 'hack back' over the last 15 years in the cyber-security community," he wrote on X, according to The National. He argued the White House "just slides this in without using the controversial names, hoping people wouldn't recognize it."

Congress has tried to legalize this twice and failed both times. Then-Rep. Tom Graves introduced the Active Cyber Defense Certainty Act in 2017 and again in 2019. Neither got a floor vote, according to SiliconANGLE. Rep. David Schweikert also pushed a "letters of marque" bill for cyber that died in committee.

Trump is doing through executive memorandum what Congress twice refused to pass into law. That raises concerns about separation of powers, regardless of whether the underlying idea has merit.

The strongest case against it

Cybersecurity experts point to targeting as the core problem. Ben Bernstein, who runs the cybersecurity advisors team at Huntress Labs, told SiliconANGLE the issue is clear: "Threat actors don't launch attacks from labeled servers in Moscow; they route traffic through compromised, innocent infrastructure, like a vulnerable router at an Ohio dental office or a hospital network." Striking back without hitting bystanders, he said, is "close to impossible on that terrain." By the time a vetted firm clears review, attackers' infrastructure has already moved on, meaning companies could end up "shooting at ghosts."

Davi Ottenheimer, a security consultant and self-described longtime supporter of active-defense concepts, was blunter. He told CyberScoop the memo is "an embarrassment to America" and compared it to "seeing somebody strapped onto a horse backwards, looking at the wrong end of a rifle." He also raised another targeting concern: the memo authorizes action against groups the administration labels criminal organizations, and Ottenheimer questioned how that designation power gets used.

Michael Garcia, a former top CISA official, framed the shift more neutrally, telling CyberScoop it's "a massive shift in the cyber policy community" and "a philosophical shift."

Not everyone is spooked. Jason Kikta, a former U.S. Cyber Command official now CTO at Automox, called it a "perpetual motion machine for billable threats," according to SiliconANGLE, a description that could read as either praise or warning depending on where you sit. And DHS Assistant Secretary Joseph Alm told the Black Hat USA conference in Las Vegas last week that the goal is deterrence: "Our long-term goal is to terrify those who would target Americans, such that they know we're actually the worst target in the world because we will mess you up," according to Cybersecurity Dive.

The memo stays quiet on a thornier problem: what happens when a "criminal organization" turns out to have ties to a foreign government. The Record noted that State Department officials have already tied Southeast Asian scam compounds to Chinese government projects, and DOJ indictments have implicated Cambodian and Myanmar officials in running scam operations. If a vetted American company hacks a group with nation-state backing, that's no longer a cybercrime case. That's a potential international incident, and the memo doesn't say who owns that risk.

The 60-day clock started August 12. Whatever procedures DOJ and DHS publish will determine whether this becomes a genuine deterrent or a legal and diplomatic mess that lands on the desk of the next administration.