Ethan Carter
The White House has granted cybersecurity firms the authority to engage in “offensive cyber operations designed to disrupt criminal organizations,” as reported by Bloomberg on Thursday.
The Trump administration has deliberated for months on this initiative, which closely resembles the historical practice of issuing letters of marque. This document, originating from the Age of Sail, provided official protections to private vessels allowing them to attack pirates and enemy ships—a legally regulated form of piracy known as privateering.
A fact sheet detailing the National Security Presidential Memorandum (NSPM) indicates that the program will be overseen by the interagency National Coordination Center, which will have two executive directors appointed from the departments of Homeland Security and Justice. This directive encourages cybersecurity firms to voluntarily establish intelligence-sharing partnerships with government entities at all levels and to propose and execute “cyber operations that effectively counter these threats.”
At present, most “offensive” cyber activities are primarily carried out by profit-driven criminals, military units like U.S. Cyber Command, or intelligence agencies and their affiliates. This is due to the potential illegality and the interpretation of such actions as aggressive, which may provoke retaliation. To avoid liability, private firms typically limit their engagement to what is termed active defense. This ambiguous concept includes measures such as seeking court orders to dismantle hacker infrastructure or creating honeypots.
The NSPM fact sheet specifies that the program’s leaders will formulate “rigorous procedures for the review and conduct” of offensive cyber operations. Interestingly, cybersecurity companies wishing to participate must secure a bond or escrow of $1 million, which can be forfeited in the event of contract violations.
The concept of hacking back is not a recent development. In 2019, CyberScoop labeled it as the “worst idea in cybersecurity” among policy experts, highlighting the challenges of accurately identifying attackers and the risk of causing collateral damage in conflicts between governments and private entities. Even officials from Trump’s administration have occasionally dismissed the notion.
In March 2026, CyberScoop reported that Thomas Lind, a senior adviser at the Office of the National Cyber Director, dismissed speculation that the White House would adopt private offensive operations. He stated at a conference that the administration is “not interested in fighting pirates with pirates.” Similarly, National Cyber Director Sean Cairncross remarked at a security summit in D.C. that private offensive cyber operations are “not what we’re discussing” when seeking greater collaboration from the industry.
There are valid reasons for this caution. Cyber attacks often involve significant obfuscation, as attackers strive to evade detection until the attack is underway, exploiting information asymmetry to their advantage. threat actors frequently operate as fragmented coalitions rather than cohesive organizations, a reality further complicated by the rise of a vast cybercrime-as-a-service marketplace and the formation of large groups such as “Scattered Lapsus$ Hunters.”
The risk of retaliatory cycles, similar to those observed in the ongoing physical and cyber conflicts between Ukraine and Russia, poses a significant concern. It’s important to note that Trump’s White House has had conflicts with the Cybersecurity and Infrastructure Security Agency (CISA) for not supporting his efforts to contest the results of the 2020 presidential election. Upon returning to office, his administration has aggressively cut CISA’s budget and staffing—this is the agency tasked with coordinating threat intelligence sharing and defensive measures when cyber threats escalate.
Daniel Mercer
