Even hack-back proponents are panning the private-sector hacking memo

A newly signed presidential memorandum enlists private sector companies in federal law enforcement hacking operations against criminal organizations, and a day after its release cyber experts told CyberScoop the arrangement carries legal, practical and moral pitfalls ^[1]. The memo sets a 60-day timeframe to establish the program, and supporters, critics and the undecided all told CyberScoop that this window is where the outcome gets decided ^[2][3].

The sharpest criticism in that reporting does not come from the usual quarter. Davi Ottenheimer, a security consultant and founder of Ottenheimer GmbH who has argued for hack back and active defense concepts that give the private sector a bigger role, called the memo "an embarrassment to America" and compared it to "seeing somebody strapped onto a horse backwards, looking at the wrong end of a rifle" ^[4][5]. That is a design objection from someone who wants the underlying policy to exist ^[6].

The memo's approach has been likened to letters of marque, the early American practice of authorizing sea privateers to attack and capture enemy ships and goods on the country's behalf ^[7]. Ottenheimer's point is that the practice fell out of favor in the 1800s for reasons: the violence it unleashed, and its contribution to mercenarism ^[8].

Then the operational objections. The memo applies to participating companies acting against transnational criminal organizations ^[9], and requires the program to establish legal and constitutional procedures for prior approval of targeting U.S. citizens, plus procedures to halt unintentional targeting of U.S. persons or systems ^[10]. Ottenheimer argues the criminal-only boundary hands control of the engagement to the target: a target that claims to be a state actor ends the operation, and, in his words, "they decided when you can and can't hack" ^[11]. He also argues it rewards ignorance, because the less an operator knows, the more easily an operation clears authorization ^[12]. And the designated get no warning: "There's no notice for you being designated. There's no prevention of you being designated. There's no way for you to know you're being designated" ^[13]. Ottenheimer also said he distrusts the intent behind the criminal designation, telling CyberScoop that political opponents are criminals in the president's view and that the memo therefore lets private organizations hack people he designates ^[14].

Michael Garcia, a former top official at CISA and now vice president of the cybersecurity practice at Monument Advocacy, called it "a massive shift in the cyber policy community" and "a philosophical shift" ^[15][16]. He supports some of the memo's ideas but worries about execution, and his specific worry is attribution: pressure to attribute faster produces lower certainty about who is being targeted, which is how a private company accidentally attacks a foreign government ^[17][18]. The legal consequence follows from there. Garcia noted that the Constitution gives the federal government the ability to wage war and that laws bar private citizens from taking up arms ^[19]. He wanted the memo to include court oversight of the program, similar to what has been required for private sector takedown operations ^[20].

Whether anyone signs up is unsettled. Garcia said he is not sure the pool of companies willing to jump into offensive cyber operations is big enough, and he framed the decision as starting with a company's lawyers ^[21][22].

Watch the 60 days for three things: whether the prior-approval procedures for targeting U.S. persons are published or kept internal, whether any court oversight is attached to the program, and which named firms acknowledge participating rather than declining quietly ^{[2][10][20][21]}.