Letters of Marque for the Digital Age: Washington Deputises Private Hackers Against Cybercrime- 348

August 15, 2026

With a national security memorandum signed on 13 August, the United States has done what its strategists have debated for a decade: it has invited private companies to go on the offensive in cyberspace. The new programme allows vetted American cybersecurity firms, under contract to the Justice and Homeland Security departments, to spy on and disrupt the infrastructure of foreign criminal networks, from scam syndicates to ransomware crews, with every operation approved in writing beforehand and anything that could kill or amount to an armed attack placed off limits. The design is careful and the bond is steep, yet the memorandum leaves the hardest questions open: whether federal hacking law actually shields a private contractor, what happens when a criminal target turns out to be serving a foreign state, and who protects the employees who will now be doing the hacking. Washington has revived, in effect, the old instrument of the letter of marque, and inherited its oldest problem, which is that privateers are hard to tell apart from pirates.

The memorandum puts into practice a promise made in March, when “President Trump’s Cyber Strategy for America” pledged to “unleash the private sector” and to build “a new level of relationship between the public and private sectors to defend America in peace and war,” and when National Cyber Director Sean Cairncross hinted that private offensive operations were coming. Its justification is blunt. American businesses, it argues, possess the scale, speed and innovation that “secure a critical offensive cyber advantage” yet “have historically been underutilized” against criminal networks, so it becomes “the policy of the United States to use all instruments of national power, including the innovative capabilities of the private sector, to combat cybercrime.” The accompanying White House fact sheet put the cost of inaction at $20.8 billion in cyber-related losses reported by American consumers last year.

The programme, run through a National Coordination Center, recognises two kinds of mission. Cyber Surveillance Operations gather intelligence on criminal networks, either to sustain further collection or to prepare later action, and are meant to remain undetected, though the memorandum concedes that even these will involve some manipulation of systems. Cyber Effects Operations go further, defined as activity that produces “the manipulation, disruption, denial, degradation, or destruction of information systems, networks, physical or virtual infrastructure controlled by information systems, or information resident thereon.” The targets are “Cyber-Enabled Transnational Criminal Organizations,” meaning any foreign group conducting cyber-enabled crime against the US government, American persons or American interests, with an explicit exclusion for entities that are institutional parts of a foreign government or operate wholly under its direction. That carve-out keeps contractors away from the terrain of state adversaries, which remains the preserve of agencies such as the NSA, and the memorandum establishes a presumption that a group is not state-directed unless clear intelligence shows otherwise.

Control is written in at every step. Program executive directors from Justice and Homeland Security must review each operations package and give written approval and direction before any action; operations that could produce “critical outcomes,” the memorandum’s term for loss of life, serious injury or anything rising to the level of use of force or armed attack under international law, are prohibited without further authorisation. Should an operation stray onto an American person or a system located in, or controlled from, the United States, the company must stop, minimise the data and notify the coordination centre, which informs the Justice Department, and contractors must also report any imminent attack on critical infrastructure or plot threatening life. Entry is deliberately demanding: rigorous vetting, proven technical capability, facility security and personnel checks, disclosure of all contractual relationships, annual re-evaluation, and a bond or escrow of at least $1 million forfeited on any breach. Operating procedures are due within sixty days, and the programme is meant to draw on both large firms and “smaller, more agile companies” for specialised tasks.

The legal foundation is where the edifice is weakest. The Computer Fraud and Abuse Act, which criminalises unauthorised access, exempts “lawfully authorized investigative, protective, or intelligence activity” by government agencies, and lawyers at Jenner & Block argue that this exemption could reach contractors acting under direct government direction, though never independent operations; but, as they note, no court has ever ruled on whether it protects private companies at all. Skadden, Arps, Slate, Meagher & Flom and RUSI’s Gareth Mott had warned before the memorandum that meaningful private participation would likely require amending the law, since the statute’s civil penalties and five-year limitation period leave firms exposed whatever the executive decides about prosecutions. Bennie Thompson, the ranking Democrat on the House Homeland Security Committee, made the same point politically, calling it a memorandum “that raises as many questions as it answers” and arguing that such powers belong in legislation agreed with Congress.

The sharper risks lie beyond American courts. The line between criminal and state actor that the memorandum treats as a presumption is, in practice, often blurred: the State Department has itself said that many of the Chinese gangs running Southeast Asian scam compounds are tied to Chinese government projects, and recent Justice Department indictments implicated government and military officials in Cambodia and Myanmar. A contractor disrupting such a network could find itself, in the eyes of the target state, an agent of American hostilities, with no clear protocol for misidentified targets or for mistakes. Experts have also warned that the employees doing the work could become targets themselves, citing the recent arrest in Italy and extradition to the United States of a Chinese national accused of working for a firm that hacked American companies on Beijing’s behalf. Washington has long condemned exactly that model, private contractors conducting offensive operations for a state; by adopting its own version, it may find its objections harder to sustain, and its own citizens more exposed abroad.