Pay $1 million first, then you're cleared to hack into other people's computer systems—that's the most concrete line in the whole memo. President Trump has signed a new National Security Presidential Memorandum authorizing private companies to conduct cyberattacks on "transnational criminal organizations" on behalf of the federal government. According to the White House, the goal is to tap "private-sector capabilities and innovation" to fight back against ransomware, sextortion, financial fraud, and phishing schemes.
Historically, the Computer Fraud and Abuse Act (CFAA) has been the main legal basis for treating unauthorized hacking as illegal in the US, applying equally to companies and individuals. Back in 2022, the Department of Justice said it would stop prosecuting white-hat hackers acting in good faith for security research. This new memo, however, massively expands the DOJ's discretion to decline prosecution—stretching it from research activity all the way to actual offensive operations.
The details right now are basically a blank slate. The memo tells a Homeland Security task force to work out, within 60 days, the criteria for vetting participating companies and the actual procedures for carrying out these operations. So far there's exactly one concrete threshold: companies that want in have to post a $1 million bond, which gets forfeited if they don't follow government instructions.
The memo offers domestic legal protection and a clear financial incentive, but it leaves one thing completely unaddressed: what happens if these companies or their employees end up prosecuted abroad—in whatever country the targeted computers happen to be located in—because of these attacks. The memo comes on the heels of multiple cyberattacks on water utility systems in Minnesota and Michigan, which were later linked to Iran. And the US itself has prosecuted foreign hackers more than once before—meaning the American companies signing up for this contract may end up facing the exact same playbook their own government has long used, just aimed back at them by someone else.
