For decades, U.S. cybersecurity firms could defend networks. Attack foreign criminal infrastructure? That crossed a legal line nobody touched. A White House memorandum reportedly dated August 2026 moves that line — authorizing vetted private companies to conduct offensive cyber operations against foreign criminal networks, according to reporting. Think ransomware gangs, phishing syndicates, sextortion rings. This isn’t a green light. It’s a leash, and the federal government holds it tight.
Controlled Aggression: What the Framework Actually Permits
The new framework opens two specific lanes for private firms — but every move requires federal sign-off before anyone touches a keyboard.
Two activity types reportedly make the cut: cyber surveillance for intelligence collection, and cyber effects operations designed to disrupt, deny, degrade, or destroy systems and data targeting criminal networks. Before any operation launches, written approval is required. Department of Justice and Department of Homeland Security representatives must both sign off. Participating firms also post a $1 million escrow or bond — forfeited if they step out of line.
The guardrails, as reported:
- Written federal approval required before any operation
- DOJ and DHS sign-off mandatory
- $1 million escrow or bond; forfeitable for non-compliance
- Firms must halt and report immediately if a U.S. person or domestic system is unintentionally affected
- Additional government guidance expected within approximately two months
“Half-baked,” according to cybersecurity veteran Jake Williams, speaking to TechCrunch. Williams warned that Americans participating in these operations could be treated as “non-uniformed combatants” by foreign governments — meaning detention or prosecution for people just doing their contracted jobs overseas.
The Legal Tightrope Nobody Has Walked Before
The policy doesn’t rewrite federal anti-hacking law — it carves out a supervised exception that could face serious pressure the moment it meets a courtroom or a foreign government.
That risk is real and specific. The Computer Fraud and Abuse Act has long treated private offensive hacking as a federal crime. This policy doesn’t rewrite the CFAA — it reportedly carves out a supervised exception, like a designated smoking area in a building that otherwise bans it entirely.
Supporters frame the program as deploying private-sector expertise where it’s needed most — against criminal networks targeting water infrastructure, hospitals, and financial systems. Critics warn the framework could diffuse accountability across agencies in ways that resist clear audit trails. The White House reportedly plans annual reviews. Formal guidance arrives in roughly two months.
For any cybersecurity professional watching this: your industry just reclassified what “going on offense” means. Whether that’s an opportunity or a liability depends entirely on which side of the escrow agreement you’re standing on.
