Trump wants private companies to hack foreign criminals — but who watches the contractors?

The Trump administration's Wednesday memorandum extends America's offensive cyber reach by authorizing vetted private companies to pursue foreign criminal networks, filling a capability gap that government agencies alone have failed to close. The initiative signals a deliberate shift in how the United States projects power in the digital domain. --- THE CONTEXT --- Existing anti-hacking laws restrict private actors from offensive digital operations except in law enforcement contexts. The memorandum preserves that legal architecture while creating a federal contracting mechanism that brings rigorous accountability requirements — including financial guarantees — to private participants, distinguishing this from an ungoverned privatization. --- THE FACTS --- Participating companies must contract with the Department of Justice or the Department of Homeland Security, submit to rigorous vetting and deposit one million dollars subject to government confiscation for non-compliance. Joshua Steinman, who served as senior director for cyber policy on the National Security Council during Trump's first term, identified organized crime, money laundering and related criminal enterprises as the primary target range. Arthur Tellis, a former Department of Defense staffer and fellow at the Institute for Progress, assessed that private firms would excel at intelligence gathering and surveillance rather than direct disruption operations. Steinman noted that smaller firms, venture-capital-backed startups and established contractors would likely compete for the opportunity. --- THE POSITIONS --- Two Republican lawmakers have separately introduced legislation to formalize cyber privateers, drawing on the historical precedent of 16th-century naval letters of marque. The memorandum does not go that far, though it generated strong online support from that legislation's advocates. The Department of Justice and the Department of Homeland Security have not published the operational protocols that would govern contracted activities. --- WHAT REMAINS UNKNOWN --- No interagency coordination framework has been made public. It is unclear how the program will interact with existing intelligence community operations or what happens when a contractor's operation intersects with a foreign state actor rather than a criminal network. --- UNANSWERED QUESTIONS --- • What chain-of-command structure will govern a private company's actions once an operation is underway? • How will the administration prevent adversarial nations from using contractor activity as a legal or diplomatic pretext for retaliation? • What congressional oversight mechanism will apply to contracts and operations conducted under this program? • How will the government distinguish between a foreign cybercriminal network and a state-sponsored one if the two are intertwined? --- EPM ANALYSIS --- The memorandum is a strategic asset if properly managed. The financial deposit and mandatory federal contracting create real compliance incentives that distinguish this from an uncontrolled privatization of state power. The institutional risk lies not in the concept but in the absence of a published inter-agency command structure. If oversight matches ambition, the United States gains measurable deterrent capacity against foreign criminal networks. 📌 📌 EPM Take: In EPM's view, the United States has long underutilized its private-sector technological advantage against foreign criminal actors who face no equivalent constraint. The Trump memorandum corrects that imbalance, but its success depends entirely on whether the oversight architecture is built before operations begin rather than after the first incident. EPM's broader coverage of how institutional gaps create irreversible costs argues for publishing that framework immediately, not leaving it to executive discretion.

---