White House plans private hack-back program against foreign cybercrime groups

The White House has directed the National Coordination Center to create a programme that could allow vetted private cybersecurity firms to carry out limited offensive cyber operations against foreign criminal groups.

The new private hack-back program would operate under US government authority and target transnational organisations linked to ransomware, phishing, fraud, sextortion and impersonation scams.

President Donald Trump signed the national security presidential memorandum on Wednesday. It tasks the National Coordination Center, which sits within the Homeland Security Task Force, with building the framework for the initiative.

Security firms would need government approval

Private companies would not be able to launch their own cyber operations independently. Instead, security firms would need to apply to join the programme and undergo vetting before entering contracts with either the Justice Department or the Department of Homeland Security.

The memorandum calls for executive directors chosen by those departments to oversee the work. Participating firms could gather threat intelligence with other private organisations and federal, state, local, tribal and territorial agencies.

They could then propose cyber operations aimed at specific criminal threats. The US government would retain control and authority over any approved action.

According to the White House, the framework will include strict review procedures for both proposed operations and their execution. Officials must ensure that each activity complies with the US Constitution, federal law and relevant international obligations.

$1 million bond required for participating firms

Companies that join the private hack-back program must maintain a bond or escrow account worth at least $1 million. The government can forfeit that money if a company breaches the terms of its agreement.

The rules also require firms to stop an operation immediately if they discover activity outside its approved scope.

That includes accidental targeting of US citizens, US-based systems or other unintended targets. Firms must then notify the National Coordination Center about the incident.

These safeguards appear designed to limit legal and operational risks in a field that has traditionally remained the responsibility of government agencies. Offensive cyber activity can quickly create diplomatic consequences, damage unrelated systems or interfere with investigations.

White House targets cyber-enabled crime

The White House said the programme will focus on foreign criminal organisations that use the internet to attack and defraud Americans.

Ransomware groups, phishing operations and financial fraud networks are among the stated targets. Officials also highlighted sextortion and impersonation scams, which often rely on stolen data, social engineering and compromised online accounts.

US consumers reported losses of more than $20.8 billion from cyber-enabled crime during 2025, according to the White House.

Cybersecurity experts described the memorandum as a significant change in US cyber policy. Veracode co-founder Chris Wysopal said it expands the private sector’s role in offensive cyber operations, while former Cyber National Mission Force leader Jason Kikta questioned whether the model could encourage a growing commercial market around cyber threats.

The details of how the private hack-back program will work in practice remain unclear. Its eventual scope will depend on the procedures now being developed by the National Coordination Center, the Justice Department and the Department of Homeland Security.