Before private companies hack back, the government needs to set the rules

On Aug. 12, the White House signed a national security presidential memorandum directing the National Coordination Center to use vetted U.S. companies in cyber operations against foreign transnational criminal organizations under federal oversight.

The rationale is understandable. The FBI received more than a million cybercrime complaints in 2025, with reported losses reaching $20.9 billion — a 26 percent increase from the year before.

Some of the most consequential details of the new program have not been written yet. The National Coordination Center’s executive directors have 60 days to establish operating procedures, and no operation can be approved until those procedures are in place.

For years, hacking back has been debated as a question of capability. If we know where cybercriminal infrastructure is, and have the ability to disrupt it, why shouldn’t we? The harder questions begin once offensive cyber operations move from government agencies into private hands.

The appeal is obvious. Cybercriminals move quickly and exploit jurisdictional boundaries, so giving vetted companies more latitude could bring expertise and speed. But speed is only one measure of success. Before the first operation is approved, the National Coordination Center needs clear standards for collateral risk, targeting, intelligence preservation and accountability.

Cyber infrastructure rarely exists in neat, isolated boxes, which makes unintended consequences one of the most immediate issues the center will have to address. If you take down a virtual private server running command-and-control infrastructure, it may be sitting on shared infrastructure alongside legitimate businesses. Even a limited operation could disrupt unrelated organizations. In the extreme case, a hospital or municipal service could be caught downstream.

That risk becomes more complicated once adversaries know offensive operations are coming. Co-tenancy can become a defensive strategy, giving criminals an incentive to place infrastructure alongside organizations where disruption would create unacceptable collateral damage. What looks like an accident today can become the adversary’s design tomorrow.

That leads to the accountability question. The government authorizes, a private company executes, harm follows, and it becomes less clear who the affected hosting provider or legitimate business ultimately pursues.

Government oversight can reduce some risk, but it cannot eliminate it. The National Coordination Center’s procedures should specify who can accept collateral risk, what level of downstream harm is unacceptable, and who bears responsibility when those limits are crossed.

Even when the target is clear, operators must decide whether to disrupt it immediately or preserve access to collect intelligence and identify the people behind it.

Historically, waiting has had clear advantages. Infrastructure is cheap and easily replaced, while the people operating criminal enterprises are harder to remove. A USENIX Security 2025 study found that more than half of the sites seized in one takedown wave returned within a median of one day, while all the services seized in a second wave returned within two days. Acting too quickly can also destroy evidence that might support arrests or more consequential coordinated operations.

AI may be changing the calculation around when to act. Cyberattacks can now move and scale faster, while multinational investigations, extraditions and arrests still proceed at human speed. If infrastructure is actively causing harm, disrupting it at the point of discovery may protect more victims than preserving access for an arrest that could take years or never happen.

The NCC’s procedures should enable immediate action when the speed and scale of harm demand it, while preserving intelligence whenever possible. The program could create a valuable channel for private companies to share information about criminal infrastructure, tactics, victims and connections across campaigns with government agencies pursuing broader investigations.

The final issue is bigger than any individual operation. Russia and China have long benefited from relationships with tolerated, state-aligned or proxy actors that create distance between governments and offensive cyber activity. Formal U.S. authorization and oversight are not the same as tacitly tolerating criminal hackers, but other governments will still study the model.

Once the United States establishes a framework allowing private companies to participate in offensive cyber operations, others may adopt the concept without the same safeguards. The National Coordination Center should write its rules with reciprocity in mind. Would the U.S. consider the same conduct legitimate if another government authorized one of its companies to carry it out?

Success cannot be measured solely by how quickly something is knocked offline. The challenge is to create rules that account for what an operation might disrupt, what intelligence it might sacrifice and what precedent it might set before anyone pulls the trigger.

Colin Ferris is the threat hunting and incident response lead at Silverfort.