Trump administration approves private hacking of foreign cybercriminals

The White House has issued a directive permitting private security firms to conduct federally sanctioned cyber attacks against foreign-based criminal networks that target U.S. citizens, organizations, and government systems.

New Authorization#

President Donald Trump signed a National Security Presidential Memorandum on Thursday establishing a framework through the National Coordination Center—operating within the Homeland Security Task Force—to orchestrate offensive cyber operations targeting transnational criminal organizations. The Justice and Homeland Security departments will oversee the initiative, with private-sector companies serving as key participants in executing these operations.

Scope of Eligible Targets#

According to an accompanying fact sheet, participating firms may pursue criminals engaged in:

• Ransomware operations
• Sextortion schemes
• Phishing campaigns
• Financial fraud
• Impersonation scams

The authorization covers "cyber-enabled" criminal groups based outside the U.S. that do not receive official state support.

Capabilities and Constraints#

The directive enables private companies to conduct "Cyber Surveillance Operations and Cyber Effects Operations" using tools including spyware deployment and data destruction tactics. The memo does not explicitly restrict other offensive techniques, such as network-locking encryption attacks or distributed denial-of-service (DDoS) campaigns. This represents a significant shift: previously, private firms faced legal barriers from conducting such offensive actions without court authorization.

Historical Context#

This initiative marks the first instance in which the federal government has formally authorized the private sector to execute offensive cyber operations targeting overseas criminal actors.