President Trump has signed a national security presidential memorandum allowing federal law enforcement agencies to partner with private technology companies to execute offensive cyber operations against foreign criminal groups and international adversaries. Under the directive, vetted private sector tech firms will be permitted to work under direct federal supervision to propose, coordinate, and execute targeted cyber actions.
The move marks a significant shift in US cyber policy, formalising a role for private industry in offensive operations that have traditionally been the preserve of government agencies.
“A coalition of the willing”
Commenting on the announcement, Kyle Hanslovan, CEO and co-founder of Huntress, said, “Considering the rapidly accelerated sophistication of organised cybercrime and nation-state actors, close public and private collaboration is no longer an option. When you add the reality of AI-powered autonomous threats, the only viable solution is a stronger coalition of the willing, which we are eager to support.
One key pillar to the success of this programme will be the appropriate use of hyperscalers for their breadth of intelligence data and die-hard security research labs like Huntress for their agility and operational depth to truly disrupt adversaries. Another key pillar will be the deconfliction process to ensure private industry doesn’t interfere with the value of long term persistent access operations which often lead to public arrests and geo-political negotiations.
All-in-all, I’m proud to see the US Government push the boundaries when it comes to denying, degrading, and disrupting these measurable threats to democracy. If done correctly, I believe it will ultimately slow the illegal transfer of wealth and knowledge from Western civilization.”
Concerns over collateral damage and delay
Not all reaction has been unreserved. Ben Bernstein, cybersecurity advisor at Huntress, added, “I’m all for expanding public-private cooperation because the government clearly can’t fight transnational cybercrime on its own, but I have concerns about how this actually plays out in the wild. When you look at the operational reality of green-lighting private offensive ops, you hit two massive roadblocks: collateral damage and bureaucratic lag.
Threat actors don’t launch attacks from labeled servers in Moscow; they route traffic through compromised, innocent infrastructure, like a vulnerable router at an Ohio dental office or a hospital network. That makes it practically impossible to “strike back” without taking out innocent bystanders. Plus, adversary infrastructure is incredibly ephemeral, often burning down in a matter of hours. By the time a vetted firm submits a target, sits through the DOJ and DHS deconfliction reviews, and finally gets a green light, they’ll be shooting at ghosts. Expecting government bureaucracy to move at the speed of modern ransomware operators is wildly optimistic.”
A signal to adversaries
Tim Mackey, head of software supply chain risk strategy at Black Duck, struck a more cautionary tone, concluding, “Ignoring the reality that it’s difficult to identify the source of cybercriminal activity, endorsing private companies to conduct offensive cyberactivity is far more likely to increase criminal, and potentially nation-state, activity than deter it. Without careful governance and control, individuals with access to sophisticated surveillance technologies could easily abuse that access and engage in surveillance efforts for personal gain. Unfortunately, one message this memo does send to adversaries is – the US government needs private companies and their capabilities to defend against cyberattacks.”
The memorandum is likely to prompt further debate within the security community over how offensive cyber operations conducted by private firms should be governed, vetted, and deconflicted from ongoing law enforcement and intelligence operations.
