New Trump Memo Would Let Private Companies Launch Cyberattacks on Foreign Criminals
Before the United States had much of a navy, it had privateers, private ship captains handed government letters that made attacking enemy vessels legal. That relic of naval warfare from centuries past just got a software update.
In a memo issued last Wednesday, the Trump administration announced a program that could authorize some U.S. businesses to pursue foreign cybercriminals selected by the government, work that has historically been performed by federal agencies, according to NPR. Understand. This authorizes private companies, not the FBI, not Cyber Command, to break into foreign networks and break things.
Let’s be fair about the problem this tries to solve, because it is real and it is enormous. According to the FBI’s Internet Crime Complaint Center, cyber-enabled crimes defrauded us of nearly $21 billion in 2025 alone, with over one million complaints filed, and losses jumped 26 percent in a single year, as reported by CyberScoop. Older adults over 60 reported roughly $7.7 billion in losses, up 37 percent from the year before, according to the FBI. This is not abstract. It is your grandmother’s savings, your hospital’s patient records, your town’s water bill. Just last month, Minnesota officials reported dozens of local water systems were targeted in a coordinated cyberattack that American intelligence links to Iran.
So yes, the frustration is legitimate. Government agencies have not kept pace, and the criminals operate from places our courts cannot reach.
But here is where the plan gets shaky. The memo does not describe how targets would be selected, what vetting would look like, or the legal justification for disruptive attacks, NPR reports. Participating companies would sign contracts with the Justice Department or Homeland Security and set aside $1 million the government can collect if they fail to meet obligations, according to Help Net Security. One million dollars. That is the deposit for wielding powers we normally reserve for the state.
Veteran security executive Chris Wysopal told NPR he wants no part of it, warning that a company could take down a hospital’s servers or a transportation firm by mistake when its blast radius runs too big. And former homeland security official Paul Rosenzweig notes that anything these companies do overseas will almost certainly violate the domestic laws of the countries where they act. When a startup in Austin sabotages a server in a country that considers it a crime, who answers for it? You do. We do. Because many foreign hacking groups blur the line between criminal and state sponsored, and hitting the wrong one could ignite an international incident.
There is a reason we stopped issuing letters of marque. Force wielded for profit, with public consequences and private accountability, tends to end badly. The agencies have two months to answer the open questions, according to NPR. We should spend those two months asking loudly: who watches the privateers? Go beyond the headlines…
Even some Republican voters sour on Trump
Hungary uses sunken barges to raise Danube River to keep nuclear plant going
Can a student ID be used for voting? More Republican-led states are banning it
What is a peanut butter pay raise, and why you may not get one next year
How to Ease Polarization Using Science
Unforgetful is a new reminders app for people who can’t stop hitting snooze
Avocado pickers in Mexico welcome restart of exports to US, but security fears remain
BP to develop offshore gasfield in Venezuela with firms linked to Trump administration
