US deputizes private firms for cyber enforcement, creating untested corporate liabilities
A new presidential memorandum allows private companies to conduct offensive cyber operations against transnational criminals, opening a new market but exposing contractors to unprecedented legal and geopolitical liabilities.
On August 12, the White House issued a memorandum allowing the federal government to deputize vetted private corporations for law enforcement operations against transnational cybercriminals. The initiative aims to leverage private sector capabilities to disrupt foreign attackers who currently evade traditional law enforcement reach.
This public-private partnership targets a massive financial drain, with Americans reporting over $20.8 billion in losses to cyber-enabled crime during 2025. These incidents span ransomware, phishing, sextortion, and financial fraud, impacting 73% of U.S. adults while disproportionately harming seniors, children, and low-income families.
The Computer Fraud and Abuse Act of 1986 has long criminalized unauthorized access and the transmission of damaging code, effectively barring private entities from striking back. By invoking an untested exception to this statute, the memorandum creates a new operational frontier for cybersecurity firms willing to cross the digital border.
For investors and executives, the program introduces severe, unquantified balance sheet risks. The legal shield for participating firms remains entirely untested in court, meaning companies could still face civil lawsuits from victims or state-level prosecutions despite federal non-prosecution assurances.
Operational complications further complicate the financial calculus for participating firms. Criminal networks frequently route traffic through commandeered hospital servers, small business routers, and university networks. The memorandum provides no framework for handling third-party collateral damage when these systems are disrupted, creating significant exposure regarding insurance coverage and corporate reputation.
The geopolitical stakes elevate the corporate risk profile far beyond standard commercial disputes. Private employees conducting these operations lack sovereign immunity and could face arrest abroad under foreign hacking laws. This mirrors the recent case where a Chinese citizen was arrested on vacation in Italy and extradited to the U.S. for allegedly hacking American companies.
Furthermore, destructive private cyber operations could be misinterpreted by adversary states as armed attacks, potentially triggering international conflict. Operating procedures detailing these safeguards are due in 60 days, but the ultimate viability of this new market will be decided in courtrooms. A program that successfully protects consumers could redefine public-private partnerships, provided it avoids accidental geopolitical escalation.
