Skip to content

Back to the catalog

Socket: White House Authorizes Private Companies to Conduct Offensive Cyber Operations
socket.devarticle

Socket: White House Authorizes Private Companies to Conduct Offensive Cyber Operations

A White House presidential memorandum creates a formal DOJ/DHS-managed program letting vetted U.S. cybersecurity companies conduct 'cyber surveillance' and 'cyber effects' operations (data access, disruption, or destruction) against foreign cybercrime infrastructure under government approval, building on a March 2026 executive order. The piece covers the CFAA §1030(f) legal basis (per Robert Graham's analysis), the DOJ/DHS approval process via the Homeland Security Task Force's National Coordination Center, vetting and bonding requirements, and industry pushback from Kevin Beaumont and Jason Kikta over conflict-of-interest incentives when ransomware-adjacent firms are paid to both detect and disrupt threats.

TL;DR New White House memorandum lets DOJ/DHS-vetted private cybersecurity firms conduct government-approved offensive surveillance and disruption operations against foreign cybercrime infrastructure under CFAA §1030(f).
Open original ↗
Document

What it is

A White House presidential memorandum establishing a federal program under which vetted U.S. cybersecurity firms can conduct government-directed offensive operations against foreign cyber-enabled transnational criminal organizations. The program is managed by the Homeland Security Task Force's National Coordination Center, with executive directors appointed by DOJ and DHS. This document adds the operational path, the participation requirements, and the unresolved legal exposure that the catalog summary does not carry.

How it works

A participating firm receives threat information from businesses and agencies, develops a proposed operation, and submits an operation package to the National Coordination Center. Every operation requires written government approval; there is no blanket authority. Robert Graham (Errata Security) frames the memo as a transfer of authority rather than data — specifically CFAA §1030(f) — so that a firm tracking a specific APT group can get permission to hack that group's machines, but not APT groups generally.

Preconditions / Affected

Relevant to firms considering participation. To take part a company must:

  • Be accepted into the program and operate under a DOJ or DHS contract.
  • Pass technical, personnel, facility, and security vetting.
  • Post a bond or escrow of at least $1M, forfeitable for contract violation.
  • Stop and report any operation that moves beyond the approved target or scope.

Targets are limited to foreign criminal groups attacking U.S. interests (ransomware, phishing, financial fraud, sextortion, impersonation scams).

Caveats

  • Legal protection is untested. Per a Lawfare analysis (Cooper, Chertoff, Pillay), no court has addressed whether §1030(f) protects private companies acting for the government. The memo cites §1030 but does not amend it or explain what protection contractors have under foreign computer-crime laws.
  • Cross-border deconfliction is unspecified. Coordination is mandated across DOJ, State, Treasury, the Department of War, and the IC, but coordination with foreign law enforcement is unclear — MacColl (RUSI) warns of disrupting a European agency's multi-year ransomware operation.
  • Operations that could cause death, serious injury, or rise to armed force under international law appear to be excluded (the page text is cut off at this point).

Organisations named here

  • CFAA §1030(f)
  • Homeland Security Task Force National Coordination Center

Technologies named here

  • CrowdStrike

Techniques named here

  • Cyber surveillance operations
  • Cyber effects operations

Threat actors named here

  • BlackCat ransomware group
  • Chinese APT group
  • BlackCat

Related in GRC