Trump Authorizes Private Hack-Back on an Untested Legal Theory

A Law-Enforcement Exemption Never Tested on a Contractor

The memorandum the President signed on August 12 creates something the United States has never had: a formal channel for private companies to conduct offensive operations against foreign hackers, run through a National Coordination Center under the Departments of Justice and Homeland Security.⁵ Two Program Executive Directors, one from each department, must jointly approve every operation in writing before a company may act. They may not approve anything that risks a "Critical Outcome": loss of life, serious injury, or an act rising to a use of force under international law.⁵ Every participating company undergoes vetting on technical proficiency, performance history, and personnel security, and must post a bond of at least $1 million, forfeitable if it breaks the rules.⁵ If an operation unintentionally strikes a U.S. person or a U.S.-based system, the company must halt immediately and report it, and anything touching a U.S. person at all needs prior Justice Department review.⁵ Read on its own terms, this is a chartered, monitored program, and the administration frames it that way: the private sector operates "under the direction, control, and authority of the U.S. Government."⁶

The guardrails all rest on one point the memo asserts but never resolves. The Computer Fraud and Abuse Act, the federal law that makes unauthorized computer access a crime, has for decades carried a narrow carve-out at 18 U.S.C. § 1030(f): it doesn't reach "lawfully authorized investigative, protective, or intelligence activity" by a government agency. The memo doesn't ask Congress to widen that carve-out for hired hackers. Instead, Section 2(b) states that the Program "shall conduct all Program activities in accordance with... section 1030," and Section 2(a) frames every operation as part of the government's own law enforcement work — the memo's way of arguing its contractors already sit inside the exemption because federal officials approved and are watching what they do.⁵ Unlike the Active Cyber Defense Certainty Act, an earlier proposal that would have amended the CFAA directly and that Congress rejected twice, this memo leaves the statute's text untouched and argues compliance through that reading instead.⁷

No court has agreed, because no court has been asked. Three attorneys at Jenner & Block, writing on this exact exemption months before the memo existed, put it plainly: "no court has addressed whether this exception provides any protection for private-sector entities engaged to perform these activities on behalf of the U.S. government."⁸ A second legal team, at Crowell & Moring, goes further. The riskiest category of hack-back activity, actually disabling an attacker's infrastructure, carries "near certain" CFAA exposure "absent explicit government authorization." After-the-fact government oversight is not the same thing as a court ruling that the oversight counts.⁹ Tonya Ugoretz, who ran intelligence at the FBI before the memo was written, makes the same point from the other side of the podium: "the memo doesn't directly address legal liability for private sector companies."²

Misattribution, Then Escalation

Call the first failure misattribution: hitting a system that isn't the one it looks like. A Cyber Effects Operation approved against a foreign Cyber-Enabled Transnational Criminal Organization's infrastructure, the memo's own terms for the group and the operation type, isn't aimed at a person. It's aimed at an IP address or a server that a target-identification rubric has to correctly link to that specific criminal group before anyone acts.⁵ Chris Wysopal, Veracode's co-founder, names the failure mode directly: hacking a data center to target scammers could, he said, inadvertently affect a hospital.¹ Michael Garcia, a former senior CISA official, pushes the same risk one step further: get the attribution wrong and a private company could "accidentally attack... a foreign government" rather than a criminal ring, a mistake he frames as a constitutional problem, because "the federal government has the ability to wage war" and private citizens cannot.³

Call the second failure escalation, and it starts exactly where misattribution leaves off. Once a vetted company is inside a foreign network, the memo's Critical Outcome ceiling stops loss of life or an act of war, but it says nothing about a target that reacts before anyone can pull the operation back.⁵ Davi Ottenheimer, a longtime advocate of active defense, nonetheless calls this Program "an embarrassment to America." He points to a structural trap in how the memo defines a legitimate target: a group that credibly claims state affiliation stops being a criminal organization, and the authorization ends with it. As Ottenheimer puts it: "Boom. They decided when you can and can't hack."³ That rewards a target for claiming a shield, and it does nothing for the minutes or hours a company keeps operating before anyone confirms whether the claim is real. Andrew Schoka, formerly of U.S. Cyber Command, names the coordination problem underneath both failures: deconfliction "is already a major challenge for federal agencies," worsened by adding "private sector firms with a lot more capability and speed."¹

From Sharing Intelligence to Pulling the Trigger

The August memorandum is the second step in a five-month widening of what the private sector is allowed to do.

1. Mar. 6, 2026

   Executive Order 14390¹⁰

   Directs the Justice and Homeland Security departments to use "threat intelligence... from commercial cybersecurity firms" to improve government attribution and disruption. Companies supply information; the government still acts on it.

2. The same week, National Cyber Director Sean Cairncross frames the administration's posture as "shaping adversary behavior, introducing costs and consequences,"⁸ and, in the same cautious register, insists the administration is "not asking the private sector to conduct offensive cyber operations."⁹

3. Aug. 12, 2026

   The hack-back memorandum⁵

   For the first time, a federal document authorizes vetted companies to conduct offensive operations themselves, not merely supply intelligence for the government's own.

Five months separate a request for help attributing attacks from a green light to disable the infrastructure directly, and the same untested exemption theory now has to stretch across that entire gap.

The Capacity Case for Deputizing the Private Sector

The strongest case for the Program starts with capacity. According to CNN's reporting, former FBI Director Christopher Wray has put the mismatch at fifty Chinese state-linked hackers for every FBI cyber agent, a ratio CNN attributes to Wray but that no primary Wray statement in the record independently confirms.¹ Whatever the precise ratio, the argument doesn't need it to be exact: consumer losses to cyber-enabled fraud reached $20.8 billion in 2025 by the administration's own count, a figure the White House's fact sheet does not trace to any underlying study.⁶ Amanda Naylor, the National Security Council's director of cyber policy, worked on the memo. She frames the Program as putting an underused resource to work: "the capabilities, speed, and innovation of the American private sector into the fight against transnational cybercrime and fraud."³ Cairncross has described the administration's broader posture as "shaping adversary behavior, introducing costs and consequences,"⁸ and NSC senior director Alexei Bulazel puts it more bluntly: the government is "unapologetic, unafraid to do offensive cyber."⁸ Joshua Steinman, founder of the cybersecurity firm Galvanick and a former Trump NSC senior director, argues the Program brings parity with how China and Russia already use contract hackers. He insists the companies doing it will stay disciplined: "We operate like a Boy Scout in cyberspace... It's measured and reasoned."³ The guardrails aren't nothing to their own supporters, either. Ari Redbord of TRM Labs calls the Program "a huge step toward empowering the private sector at a critical moment."³ Cynthia Kaiser, a former senior FBI cyber official, backs the capacity logic but still wants clearer answers on liability before companies sign up, a condition that runs through the criticism just as much as the support.¹

Capacity is real, and so is the guardrail language, but neither reaches the two failures already on the record. A bounded program can still misattribute a target, because the boundary is a written-approval process, not a technical safeguard against picking the wrong server.⁵ A per-operation sign-off can still escalate, because Justice and Homeland Security can approve an operation and still have no way to stop a target from reacting once the company is already inside a foreign network.¹ And the capacity argument doesn't touch the legal one: however outnumbered the FBI is, being outnumbered doesn't put a private contractor's own hacking inside a law-enforcement exemption that no court has read that way.⁸ Even the Program's own supporters keep pointing to what its guidance has not filled. Redbord, who calls the memo a step forward, still flags what it leaves out: the memo says nothing about what happens to seized assets or how a victim gets compensated, mechanics still left to guidance that doesn't exist yet.³

None of this settles what happens once a company actually gets a green light. The memo requires the Executive Directors to write the Program's operating procedures within 60 days of signing, and until they do, it cannot lawfully approve an operation at all.⁵ The case for privatized offense is still resting entirely on paper. A track record could change that: an operation with attribution a court or a reporter could check, no hospital or foreign government hit along the way, and a ruling that the exemption theory actually holds. None of that exists yet. Until it does, the Program is asking Americans to trust an untested legal theory and an approval chain no operation has tested, for a problem too serious to run on trust alone.