Offensive hacking becomes a procurable service, gated by a $1 million forfeitable bond

A presidential memorandum published Wednesday authorises private firms to conduct cyberattacks against foreign criminal groups while operating "under the control and oversight" of the federal government, including permission to surveil and disrupt those networks ^[2]. The program was first reported by Bloomberg ^[1], and it converts something that used to be a government function into a line item a vendor can bid on ^[12][2].

The gating criteria are worth reading closely. The Department of Justice and the Department of Homeland Security will oversee participating firms, which must satisfy requirements in "technical proficiency, proven performance of cyber operations, facility security," and more ^[5]. Participants must also hold a bond or escrow of at least $1 million, forfeited if they breach their contractual agreement ^[6]. Of the qualifications described in the source material, the bond is the only one expressed as a number ^[1]. Everything else is judgement exercised by two departments, which means the real qualification bar is discretionary and unpublished.

The scope limit is a single sentence doing a great deal of work: firms may only hack groups that are "not an institutional part of a foreign government or wholly operated under a foreign government's direction" ^[7]. Cybersecurity Dive has noted that identifying which criminal groups are affiliated with foreign governments is difficult, and that getting it wrong could pull security firms into geopolitical or legal conflicts ^[10]. Jason Healey, a senior cyber conflict researcher at Columbia University, told Cybersecurity Dive that "Anyone conducting these operations is doing so at substantial personal legal risk" ^[11]. Jake Williams, vice president of research and development at Hunter Strategy, told TechCrunch that "Americans participating in these operations could easily be classified as non-uniformed combatants while traveling overseas" ^[13]. That is an employment risk, not just a corporate one.

For anyone running infrastructure, the more immediate change is to the threat model. Ben Bernstein of Huntress puts the problem concretely: attackers do not operate from labelled servers in Moscow but route traffic through compromised third-party infrastructure such as a vulnerable router at an Ohio dental office or a hospital network, which he says makes it "practically impossible to 'strike back' without taking out innocent bystanders" ^[14]. If your firewall, VPN appliance or clinic router is being used as a relay, you are now a potential waypoint in a sanctioned disruption operation as well as a criminal one. Incident response playbooks that assume hostile traffic is criminal and friendly traffic is law enforcement no longer cover the field.

The memorandum's framing is that private businesses are an "underutilized" force against criminal networks ^[8], and that United States policy is to use "all instruments of national power, including the innovative capabilities of the private sector, to combat cybercrime" ^[9]. Trump began planning private-sector involvement last year, according to Bloomberg ^[4].

Watch three things. Whether the list of qualified firms and the terms of their contracts are made public, since oversight by DOJ and DHS ^[5] is only auditable if the awards are visible. Whether the $1 million bond ^[6] is the ceiling on a firm's exposure when a disruption operation damages an uninvolved third party, or merely the government's remedy for contractual non-compliance. And whether any firm publicly declines to participate, given the personal legal exposure described by Healey ^[11] and Williams ^[13].