US Government Authorizes Private Firms for Cyberattack Operations

In a significant move, President Donald Trump has approved a national security memorandum that empowers private companies to carry out cyberattacks against “transnational criminal organizations” on behalf of the federal government. The administration aims to harness the “capabilities and innovation of the private sector” to combat threats such as ransomware, sextortion, financial fraud, and phishing schemes.

Historically, the Computer Fraud and Abuse Act (CFAA) has governed the legality of hacking, unauthorized access, and cyberattacks, applying equally to both individuals and corporations. In 2022, the Department of Justice indicated it would cease prosecuting white-hat hackers conducting security research. this new presidential memorandum significantly broadens the scope of cyber activities that the DOJ may choose not to prosecute.

Specifics regarding the implementation of this initiative remain unclear. The memorandum instructs the Homeland Security Task Force to establish criteria for vetting companies interested in participating, along with protocols for executing cyberattacks. These guidelines are expected to be released within the next 60 days. companies opting to participate must pay a $1 million bond, which will be forfeited if they fail to adhere to government directives.

While this framework provides incentives for compliance and shields companies from prosecution under US law, it does not address potential legal ramifications for companies or their employees if they face criminal charges in the foreign jurisdictions where targeted systems reside. The memorandum follows a series of cyberattacks on water facilities in Minnesota and Michigan, which have been attributed to Iranian actors. The US has previously pursued legal action against foreign hackers, suggesting that US-led cyber offensives could provoke similar responses.