U.S. Authorizes Private Companies to Conduct Offensive Cyber Operations Abroad

The United States has formalized a framework allowing private-sector companies to launch offensive cyber operations overseas under a presidential memorandum that establishes a government-supervised program for such activities.

The directive authorizes American IT firms to conduct cyber surveillance and cyber effects operations — including the takedown of servers — targeting foreign infrastructure used for cybercrime. The program will be administered through a National Coordination Center (NCC) jointly overseen by the Department of Justice and the Federal Bureau of Investigation.

Unauthorized “hack back” actions remain prohibited; any operation must receive written regulatory approval and be coordinated with the State Department, the Treasury Department, and intelligence agencies to avoid interference with ongoing government missions.

Companies seeking to participate must pass a technical audit, undergo personnel vetting, disclose their contracts, and post an escrow bond of at least $1 million that can be forfeited for violations.

The move marks a significant expansion of private-sector involvement in national cyber defense, shifting some offensive capabilities from exclusively government hands to vetted contractors under strict federal oversight.