In a first, US will allow some private firms to carry out cyberattacks

The United States just privatized its cyber arsenal. That is the only way to read the presidential memorandum published Wednesday authorizing vetted companies to launch offensive hacking operations against criminal gangs overseas. For decades, the Computer Fraud and Abuse Act drew a bright line: private entities could defend networks, but only the government could attack them. The memorandum erases that line with a stroke.

The shift is not incremental. It is structural. The government now claims the power to deputize corporations to conduct surveillance, implant spyware, and destroy data or systems belonging to foreign actors — all under federal supervision, with sign-offs from the Justice Department and Homeland Security. A $1 million escrow deposit stands as the sole penalty for misconduct. If a company exceeds its mandate, the money is forfeited. That is not deterrence. That is a cost of doing business.

Proponents will argue the move harnesses private-sector speed and ingenuity against ransomware crews, financial fraud rings, and sextortion operators who operate beyond the reach of U.S. law enforcement. The memorandum frames this as "innovative capabilities of the private sector" deployed against threats targeting Americans. But the language masks a deeper reality: the state is farming out its most coercive digital powers to entities that answer to shareholders, not voters.

Accountability mechanisms are thin. Operations require dual agency approval and must avoid U.S. persons and systems. Participants must report imminent threats to critical infrastructure. Yet the White House declined to confirm whether any company has already been cleared to operate. The guidance defining vetting standards, operational limits, and audit procedures does not exist yet — it is due in two months. The program is live before its rulebook is written.

Legal scholars will have a field day. The CFAA criminalizes unauthorized access and damage to protected computers without exception for private actors acting on government behalf. The memorandum asserts executive authority to carve out that exception. Courts may disagree. Congress never authorized this delegation. A future administration can revoke it with a signature. The whole edifice rests on presidential will, not statutory foundation.

The international implications are sharper. When a U.S. corporation destroys a server in Moscow or Mumbai under federal direction, the line between state action and private conduct dissolves. Adversaries will treat it as state action anyway. Attribution becomes a weapon: any disruptive hack can be blamed on a "deputized" U.S. firm, giving Washington plausible deniability while expanding the gray zone of conflict. Other nations will copy the model. The norm against privatized offensive cyber operations — fragile as it was — just collapsed.

Critics have warned for years that merging corporate capability with state authority creates perverse incentives. Companies gain privileged access to intelligence, legal cover, and a marketable label of patriotism. The government gains deniability, scale, and a buffer against political blowback. The $1 million bond is trivial against the value of a contract that legitimizes offensive hacking as a service line. Firms will lobby to expand the target set. Mission creep is not a risk; it is the business plan.

The memorandum insists operations remain under federal supervision. But supervision requires visibility. The government struggles to audit its own contractors in conventional domains. Cyber operations leave fewer traces. A company that discovers a vulnerability in a criminal gang's infrastructure faces a choice: report it and lose the exploit, or exploit it and claim operational necessity. The escrow deposit does not buy thorough oversight.

There is also the question of what "criminal gangs" means in practice. The memorandum cites ransomware, financial scams, sextortion. But the same tools — spyware implantation, data destruction, system disruption — work equally well against political dissidents, journalists, or foreign governments. The safeguard is a policy directive not to target Americans. That is a promise, not a technical control. The same firms that sell surveillance software to authoritarian regimes now sit at the table with a U.S. license to hack.

The White House fact sheet calls this a "whole-of-nation approach." That phrase should alarm anyone who watches how mission creep works in the national security state. First comes the exceptional authority. Then comes the routine use. Then comes the expansion. The memorandum explicitly contemplates small firms for "specialized operations." Specialization in offensive cyber means custom malware, zero-day exploits, supply-chain compromises. The market for those skills just went legitimate.

Congress should have debated this. It did not. The memorandum bypasses the legislative branch entirely. That is the most telling fact of all. The executive branch just claimed the power to authorize private violence in cyberspace — because cyber operations are treated as below the threshold of war, beneath the notice of lawmakers, within the president's unilateral discretion. That discretion now extends to corporations.

The program may achieve tactical wins. A ransomware gang loses its decryptor keys. A fraud network goes dark. But the strategic cost is the erosion of the state's monopoly on offensive force in the digital domain. Once that monopoly fractures, it does not reassemble. The next administration will inherit the program, expand it, or lose control of it. The firms enlisted today will demand continuity tomorrow. Their investors will expect returns.

History shows that when governments outsource coercion, accountability evaporates. Privateers become pirates. Contractors become cartel. The memorandum's guardrails — dual sign-off, escrow, supervision — are paper. The capability transferred is real. The United States just told the world that offensive hacking is a service any qualified bidder can provide. It will not be able to take that message back.