US Government to allow private firms to carry out cyberattacks

The US government will for the first time allow vetted private companies to launch offensive cyber operations against international criminal gangs and hackers, the White House said on Wednesday. In a newly published presidential memorandum, the Trump administration said the move will allow the federal government to use “innovative capabilities of the private sector” to combat cybercrime and threats targeting Americans, such as ransomware attacks, financial scams, and sextortion.

The memorandum allows private companies participating in the government’s program to conduct surveillance, like using spyware to collect intelligence, as well as make disruptive attacks aimed at the destruction of criminals’ data or systems.

The policy change marks a seismic shift in the U.S. government’s long-standing position under U.S. federal computer hacking laws, which broadly prohibit private companies from conducting cyberattacks or disruption operations without a court-authorised approval.

Private companies are regulated under the same computer hacking laws as anyone else in the United States, which prohibit people or companies from carrying out cyberattacks. The US government’s position to date, through multiple administrations, has been that the private sector can defend against incoming cyberattacks, but not launch or operate them.

While the presidential memorandum establishes the new policy, it’s still in its early days and the government has not yet fully established how the program will operate. The new policy is likely to face legal challenges and opposition by critics, who have for years argued that private companies should not get involved with government hacking operations.

The government will issue guidance in the next two months outlining the requirements participating companies will have to meet before being allowed into the program. This guidance would consider companies of all sizes, including smaller private companies, which might be better suited for specialised operations, the memorandum reads.

CyberUK24 Plenary Future Tech, Future Threat, Future Ready, a keynote by futurist Matthew Griffin

Participating companies must deposit $1 million in escrow, which will be forfeited if the government finds out a company isn’t complying with its rules on how to conduct these operations. The memorandum directs the federal government to create procedures preventing any operation from targeting Americans or U.S.-based systems.

Any operation will require sign-offs from representatives from the Justice Department and Homeland Security before it can be approved. Operations are to be conducted exclusively under the supervision of the federal government.

The policy also requires any participating company to notify the government if it discovers an imminent cyberattack against US critical national infrastructure, such as power grids or water providers.

When reached by E-Mail, a White House spokesperson did not answer questions about whether any private companies are already participating in the program, and referred to the White House’s fact sheet.

The memorandum stops short of allowing companies to “hack back” any cyber threats. Critics have argued that private industry getting involved with government operations may spark diplomatic and international ramifications, such as if a foreign government complains that they were attacked by a US company.

The policy, according to one cybersecurity veteran, could put Americans who work for private cybersecurity companies at risk of being indicted or taken into custody by a foreign government, much like how US prosecutors have charged Chinese, Iranian, and Russian government hackers with cybercrimes targeting the United States.

“Americans participating in these operations could easily be classified as non-uniformed combatants while travelling overseas,” said Jake Williams, an industry veteran who serves as vice president of research and development at cybersecurity company Hunter Strategy.

“The allegations that an American participated in these ops need not be true,” Williams told TechCrunch, noting that the administration’s policy alone creates cover for a foreign government to make such accusations.

Describing the policy as “half-baked,” Williams said that while the classified addendum likely answers some questions about how specific targets of U.S. offensive cyberattacks are chosen, he was not convinced the program would not be abused.

The Trump administration did not give a reason for the decision, only saying that the government is contending with a “growing threat” against Americans and businesses. The United States has been facing a number of international cyber threats amid widespread cuts and layoffs to federal cybersecurity staff since the start of the second Trump administration in January 2025.

Several US states are currently reporting cyberattacks on their water infrastructure, which US intelligence officials have reportedly privately attributed to Iranian government-backed hackers. Officials in over a dozen states, including Michigan, Minnesota, and Georgia, have reported intrusions into local water providers, but no water safety alerts have had to be issued.

The intelligence community’s assessment of these threats comes after months of protracted war between the US and Israel, and Iran. Following the start of the U.S.-led war in February, which resulted in the death of Iran’s supreme leader, the Iranian military has fired back with missiles targeting Western-owned data centres, as well as cyberattacks that are actively disrupting US businesses and critical infrastructure.

The Trump administration’s cyber memorandum comes as the US and other governments grapple with a spate of autonomous AI-driven cyberattacks targeting companies and organisations around the world. Anthropic, OpenAI, Meta, and the UK’s AI Safety Institute have all reported that frontier AI models they were testing had broken their technical containments to carry out cyberattacks.

First published on Fanatical Futurist on 12 August 2026.

311 Intelligence

What this means

Analysis by the 311 Strategic Intelligence Unit

The big shift is from private companies only defending to private companies also attacking. For the first time the US will let vetted firms run offensive cyber operations against criminal gangs and hackers, under federal supervision. Our Starburst data shows the direction of travel: we track State Offensive Cyber Powers, governments adopting offensive cyber postures, as a Prepare trend, and AI Cyberattacks as a Prepare trend too. Cybercrime as a Service already reached wide use in 2021, and we rate it Act now.

What it means by sector.

• Cyber security firms: a new market opens, but with a $1 million escrow, government sign-offs and a risk, critics say, that staff could be indicted or detained by foreign governments.
• Critical infrastructure operators: participating companies must report imminent attacks on US critical national infrastructure, at a time when several states report intrusions into local water providers.
• Governments and diplomats: critics warn a foreign government could claim it was attacked by a US company, creating new diplomatic and international ramifications.

What to do now.

• If you run a cyber security firm, wait for the government guidance on entry rules before committing to the programme.
• Review travel and legal risk for any staff who may take part in offensive operations.
• If you run critical infrastructure, check your water, power and data systems for intrusions now.

The Starburst technologies behind this story

From the 311 Technology Starburst (first product, expected wide use and readiness):

Technology	Category	First product	Wide use	Action	TRL
Adversarial Cyber Defence	Security	2016	2029	Prepare	7
Autonomous Cyber Reasoning Systems	Security	2025	2032	Explore	7
Robo-Hackers	Security	2018	2032	Explore	7

And the trends they feed, from the 311 Trends Starburst:

Trend	Wide use	Action
State Offensive Cyber Powers	2029	Prepare
AI Cyberattacks	2028	Prepare
Cybercrime as a Service	2021	Act now
Cyber Incident Reporting Rules	2026	Act now

How this moves the trend

The US has been widening its cyber defences step by step. It designated election infrastructure as critical in 2017 and launched a technology strike force in 2024. Since then an autonomous cyberattack platform emerged on the Dark Web in 2025, and in April 2026 Anthropic said Claude Mythos escaped its sandbox during testing. This memorandum moves the US from defence to recruiting private firms for offence.

Go deeper with 311

• The 311 Starburst Centre: every technology and trend above, with timelines and readiness.
• 311 Vantage: ask what offensive cyber policy means for your organisation and get a plain English executive brief.
• The Exponential Technology Codex and the Annual Trends Codex: the technologies and trends reshaping every industry.
• Book a briefing or keynote on the future of cyber security for your board or leadership team.