White House memo authorizes vetted private security firms to run hack-back operations

Free Instant SEO Audit

By NewSunSEO August 16, 2026

A national security presidential memorandum signed on August 12, 2026 instructs the National Coordination Center (NCC) to create a program that allows vetted U.S. private security companies to conduct offensive cyber operations against foreign transnational criminal organizations, under the control and authority of the U.S. government. The framework, announced through a White House fact sheet the same day, expands the federal role of commercial cybersecurity firms in targeting criminal hacking groups responsible for ransomware, phishing, financial fraud, sextortion, and impersonation scams.

What the memorandum establishes

According to the memorandum and accompanying fact sheet, the NCC, part of the Homeland Security Task Force, will manage a Program authorizing participating companies to run cyber surveillance operations and cyber effects operations against foreign cyber-enabled transnational criminal organizations. Two executive directors, one from the Department of Justice and one from the Department of Homeland Security, will jointly approve operations. They may not, however, authorize operations producing Critical Outcomes as defined in the memorandum.

Cyber operations under the Program will be conducted exclusively on behalf of and under the supervision of the federal government, and only as part of lawful investigatory, protective, or intelligence operations carried out by federal law enforcement.

How the vetting and oversight process works

Participating companies must enter contractual agreements with either the Department of Justice or the Department of Homeland Security. The fact sheet states those contracts will ensure participating companies undergo rigorous vetting and that their performance adheres to the strict operational procedures outlined in the implementation guidance.

Companies accepted into the Program are encouraged to enter commercial agreements with other private entities and with federal, state, local, tribal, and territorial agencies. Those agreements are meant to let companies collect TCO threat information in the course of normal business and propose responsive cyber operations to the NCC.

The fact sheet sets out procedures for reviewing and conducting these limited cyber operations in compliance with the U.S. Constitution, U.S. laws, and applicable international agreements.

Compliance rules, financial bonds, and stop-work requirements

Companies that sign on must maintain a bond or escrow of at least $1 million, which is forfeited if they fail to comply with their contractual agreements. They must also immediately stop operations if they discover activity exceeding approved limits, including any unintended targeting of U.S. citizens or U.S.-based systems, and notify the National Coordination Center.

The memorandum’s purpose section frames the move as a response to the scale of cyber-enabled crime. The fact sheet reports that U.S. consumers reported losing more than $20.8 billion to cyber-enabled crime in 2025. It also cites survey figures: 73% of U.S. adults have experienced some kind of online scam or attack, and 98% of Americans believe scams pose a threat to individuals in the U.S., with two-thirds calling it a “major” threat. The fact sheet adds that one in seven young people who experienced sextortion as a minor reported harming themselves in response to the abuse.

Policy context and broader anti-cybercrime push

The memorandum builds on Executive Order 14390, signed March 6, 2026, which directed federal action against cyber-enabled crime harming American citizens. According to the fact sheet, the Trump Administration has framed the new Program as filling gaps left by what it calls outdated frameworks and the absence of meaningful consequences for foreign-based criminal networks.

Other recent steps cited in the fact sheet include the TAKE IT DOWN Act, signed in May 2025 and championed by First Lady Melania Trump to address non-consensual intimate imagery and deepfake abuse, with the first conviction under the law in April 2026. The Administration also points to a June 2025 executive order strengthening protections against foreign cyber threats, a September 2025 notice helping financial institutions detect and disrupt financially motivated sextortion, and a June 2026 NSPM that strengthens the cybersecurity of National Security Systems.

Reactions from the security industry

Responses from outside government, as reported in coverage of the memo, have been sharply divided. Veracode co-founder Chris Wysopal called the memo a “pretty big shift in US cyber policy” and “a major expansion of the private sector’s role in offensive cyber operations.” Former Cyber National Mission Force leader and Automox CTO Jason Kikta described it as “a perpetual motion machine for billable threats.”

Advocates say the framework recognizes private-sector offensive capability, while critics warn it could give security vendors a financial reason to keep finding new targets.

FAQ

What does the new White House hack-back memorandum actually allow?

The memorandum lets vetted U.S. private security companies conduct cyber surveillance operations and cyber effects operations against foreign cyber-enabled transnational criminal organizations, under the control and oversight of the federal government, with joint approval from executive directors at the Department of Justice and the Department of Homeland Security.

How much money must participating security companies put up?

Companies accepted into the Program must maintain a bond or escrow of at least $1 million, which is forfeited if they do not comply with their contractual agreements.

What happens if a company accidentally targets a U.S. person or system?

Participating companies must immediately stop operations if they discover activity exceeding approved limits, including unintended targeting of U.S. citizens or U.S.-based systems, and notify the National Coordination Center.