Loading story…
A White House National Security Presidential Memorandum on combating transnational cyber-enabled crime reportedly creates a formal pathway for U.S. private companies to conduct government-authorized hack-back operations under federal oversight. The reported policy shift moves beyond the long-standing model in which companies were limited to detecting, responding to, and reporting intrusions, and instead directs the Department of Justice and Department of Homeland Security to oversee a new mechanism for offensive action against foreign transnational criminal organizations.
According to the reports, participation would require case-by-case written approval through a joint DOJ-DHS coordination structure, with firms posting at least a $1 million bond and operating under defined federal supervision. The legal basis is said to rely on executive interpretation of the Computer Fraud and Abuse Act and its government-activity exception in 18 U.S.C. § 1030(f), rather than a new law, leaving the framework vulnerable to court challenges and possible retroactive liability if that interpretation fails. The reports also warn that misattribution, collateral damage to third-party infrastructure, escalation, and cross-border sovereignty disputes could create significant operational and legal risk for participating companies.
See the reporting duties and controls this puts on the clock.
3 events from the most recent confirmed update back to the earliest known activity.
On August 12, 2026, President Trump signed a National Security Presidential Memorandum described as shifting the long-standing boundary between private cyber defense and offensive action. The memorandum directs the Department of Justice and the Department of Homeland Security and is reported to create a formal mechanism for government-authorized private-sector hack-back operations under federal oversight.
A later Active Cyber Defense Certainty Act proposal in 2019 likewise did not move beyond congressional committees, leaving prior legal limits on private-sector hack-back unchanged.
The article states that proposed U.S. hack-back legislation, the Active Cyber Defense Certainty Act, was introduced in 2017 and 2019 but did not advance beyond congressional committees.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The White House issued a presidential memorandum creating a federally supervised program that allows vetted U.S. private companies to support cyber operations against foreign cyber-enabled transnational criminal organizations. The framework will be managed by the National Coordination Center and jointly overseen by officials designated by the Department of Justice and Department of Homeland Security, with participating firms required to contract with DOJ or DHS, disclose relevant commercial ties, and potentially post a **$1 million bond or escrow**. The memorandum authorizes both **cyber surveillance** for covert intelligence collection and **cyber effects operations** to disrupt, degrade, or destroy criminal infrastructure, but limits activity to non-state criminal groups and requires written government approval, legal review, and multi-agency deconfliction before missions proceed. It also bars operations likely to cause death, serious injury, use of force, or an armed attack under international law, and requires immediate halt-and-report procedures if a U.S. person or domestic system is accidentally affected; agencies were directed to establish operating procedures within 60 days and provide follow-on reporting within 180 days and annually thereafter.
Sep 1, 2026
President Donald Trump released a long-awaited **national cybersecurity strategy** and signed an accompanying **executive order** directing federal agencies to take action against cybercrime and fraud. The strategy is described as deliberately high-level and organized around six pillars: **shaping adversary behavior** (including greater use of U.S. offensive and defensive cyber capabilities and encouraging private-sector disruption of adversary infrastructure), **promoting “common sense” regulation** (criticizing compliance “checklists” and signaling interest in liability discussions), **modernizing and securing federal networks**, **securing critical infrastructure**, **sustaining superiority in critical and emerging technologies**, and **building cyber talent and capacity**. Multiple reports highlight the strategy’s shift toward a more **direct, “gloves-off” posture** in responding to adversarial cyber threats, with the White House framing it as a recalibration toward more forceful action against actors targeting U.S. networks. The document also ties cyber operations to broader national objectives, explicitly referencing recent administration actions (including operations linked to Iran and Venezuela) as examples of a willingness to use cyber capabilities in support of national missions, while also emphasizing emerging technologies (including **AI**) and workforce development as key enablers of the strategy’s goals.
Jun 29, 2026
The U.S. government signaled that **private industry is not expected to conduct offensive cyber operations** on the government's behalf, even as the new national cyber strategy calls for stronger collaboration with commercial partners. National Cyber Director Sean Cairncross said the administration wants to use private-sector capabilities for **information sharing, threat intelligence, and defensive support**, while offensive action remains the responsibility of agencies that already hold that authority, including the **NSA, CIA, FBI, and U.S. Cyber Command**. The same policy direction is reflected in the Energy Department's planned **first-ever cyber strategy**, which is intended to align with the national strategy and focus on protecting the energy grid through stronger public-private coordination. Energy officials said the plan will prioritize getting **timely, actionable information** to operators, improving the sector's **security resilience**, and investing in **AI for cyber defense** to counter adversaries using AI-enabled offensive capabilities against critical infrastructure.
Jun 29, 2026