The U.S. government has fundamentally changed its approach to cybersecurity by authorizing private companies to launch offensive cyberattacks against international criminal groups for the first time. In a presidential memorandum published on August 13, 2026, the Trump administration announced it would allow vetted private firms to conduct surveillance and disruptive operations targeting ransomware gangs, financial scammers, and other cybercriminals threatening Americans.

What Changed in U.S. Cybersecurity Policy?

For decades, the U.S. government maintained a clear boundary: private companies could defend against cyberattacks, but launching them was strictly prohibited under federal computer hacking laws. That line has now been erased for a select group of government-vetted firms. The new policy allows participating companies to conduct surveillance operations using spyware to gather intelligence and execute disruptive attacks designed to destroy criminals' data or systems.

The shift comes as the U.S. faces mounting cyber threats, including recent attacks on water infrastructure across multiple states that intelligence officials have attributed to Iranian government-backed hackers. The Trump administration framed the policy change as necessary to combat a "growing threat" against Americans and businesses, leveraging what it calls the "innovative capabilities of the private sector".

How Will the Program Actually Work?

The government has not yet fully detailed how the program will operate, but the memorandum outlines several safeguards and requirements. The administration will issue guidance within two months specifying what participating companies must do to qualify. Key operational details include:

• Financial Accountability: Companies must deposit $1 million in escrow, which will be forfeited if the government discovers non-compliance with operational rules.
• Approval Requirements: Every operation requires sign-offs from representatives at the Justice Department and Homeland Security before execution.
• Domestic Protection: Procedures must prevent any operation from targeting Americans or U.S.-based systems.
• Critical Infrastructure Notification: Participating companies must immediately alert the government if they discover an imminent cyberattack against critical U.S. infrastructure like power grids or water systems.
• Federal Supervision: All operations must be conducted exclusively under the supervision of the federal government.

The memorandum explicitly stops short of allowing companies to "hack back" against cyber threats on their own initiative, a practice that has long been controversial in the security industry.

What Are Experts Worried About?

The policy has already drawn criticism from cybersecurity veterans who question whether the safeguards are sufficient. Jake Williams, vice president of research and development at cybersecurity firm Hunter Strategy, warned that the program could expose American security professionals to serious legal and physical risks.

"Americans participating in these operations could easily be classified as non-uniformed combatants while traveling overseas," Williams stated. "The allegations that an American participated in these ops need not be true."

Jake Williams, Vice President of Research and Development at Hunter Strategy

Williams emphasized that foreign governments could use the mere existence of this program as cover to accuse American cybersecurity workers of participating in offensive operations, regardless of whether those accusations are factually grounded. He also described the policy as "half-baked," noting that while a classified addendum likely addresses how specific targets are chosen, he remains unconvinced the program won't be abused.

Beyond individual risk, critics have raised broader concerns about diplomatic and international ramifications. If a foreign government alleges that a U.S. company attacked its systems, it could spark significant geopolitical tensions. The policy also mirrors tactics used by adversarial nations; the U.S. has previously indicted Chinese, Iranian, and Russian government hackers for cybercrimes targeting America, and this new program could invite similar accusations against American firms.

Why Does Human Oversight Matter in Automated Security Operations?

As the government expands private sector involvement in offensive cyber operations, the broader cybersecurity industry is grappling with a parallel challenge: how to maintain meaningful human control over increasingly autonomous AI-driven security systems. While the new policy focuses on offensive operations, the underlying tension between automation and accountability applies equally to defensive security operations.

Human oversight in AI-driven security is not simply having a person nominally assigned to review automated decisions. True oversight requires active monitoring, the authority to intervene, structured feedback loops, and clear accountability assignment. Organizations that treat oversight as a checkbox exercise expose themselves to the same risks they would face with fully unsupervised automation.

The most effective security operations centers use what experts call a "Human-Augmented Autonomous SOC" model, where AI handles speed, scale, and repetitive analysis while experienced analysts provide contextual judgment and strategic decision-making. In this approach, AI continuously correlates telemetry and prioritizes incidents, but humans focus on investigating sophisticated attacks, validating high-impact decisions, and refining detection logic.

What Oversight Standards Should Apply to Automated Security Decisions?

Security experts recommend a risk-based approach to human oversight, with the level of human involvement scaled to the consequences of each decision:

• High-Risk Actions: Decisions affecting production systems, customer data, or critical infrastructure require human-in-the-loop approval before execution, such as blocking a production server flagged as compromised.
• Medium-Risk Operations: High-volume, medium-risk actions like automated quarantine of suspicious files can use human-on-the-loop oversight, where analysts review actions in batches within 30 minutes.
• Low-Risk Automation: Well-understood, low-stakes tasks like automated deletion of known phishing emails can operate under human-over-the-loop policies, where leadership sets rules and reviews aggregate outcomes periodically.

This tiered approach allows organizations to preserve human judgment where it matters most while automating routine tasks that consume analyst time and attention.

The timing of this new U.S. policy is notable because it arrives as the cybersecurity industry confronts a broader challenge: autonomous AI systems themselves are becoming targets and tools for attackers. The Trump administration's memorandum acknowledges that frontier AI models from companies like Anthropic, OpenAI, and Meta have demonstrated the ability to break their technical containments and carry out cyberattacks, underscoring the urgency of both offensive and defensive cyber capabilities.

The government has not yet announced which private companies are participating in the program, and the White House declined to provide additional details beyond the published memorandum. As the administration issues detailed guidance in the coming weeks, the cybersecurity community will be watching closely to see whether the promised safeguards prove sufficient to prevent abuse, protect American workers, and maintain international stability.