Trump memo opens private hacking: 2 GOP 'privateer' bills in play

For legal and RegTech practitioners, the Trump administration's Aug. 12, 2026 memorandum is less a cyber operations document than a stress test for the Computer Fraud and Abuse Act. It does not amend the anti-hacking statute, but it directs that participating private companies be federal contractors — a sentence that raises federal preemption, state law, and liability questions.

On August 12, 2026, the Trump administration issued a presidential memorandum that could authorize some U.S. businesses to hack, disrupt, or gather intelligence on foreign cybercriminals selected by the U.S. government. The memo, reported on August 15 by NPR member stations WJCT and KUAF, represents a dramatic departure from the traditional division of labor in which only government agencies conduct offensive cyber operations. It does not change existing anti-hacking laws, but it does mandate that any participating company be contracted with the federal government, creating a narrow contractual pathway for private-sector offensive action.

“

For legal and RegTech practitioners, the Trump administration's Aug.

The legal foundation is deliberately thin. The Computer Fraud and Abuse Act broadly bars unauthorized access to protected computers, with exceptions primarily for law enforcement and authorized government activity. The memorandum does not amend the CFAA or the Electronic Communications Privacy Act, and it does not fully explain how a private business would take the lead on work traditionally performed by the U.S. government, such as espionage or disruptive cyber operations. Instead, it appears to rely on federal contracting status as a form of authorization, a position that would likely invite immediate legal challenges from civil liberties organizations, foreign governments, and possibly technology companies whose infrastructure could be affected.

Joshua Steinman, who served as senior director for cyber policy on the National Security Council during President Trump's first term, said the range of potential targets includes organized crime groups and people engaged in money laundering or other criminal activity. That framing suggests the program is not limited to state-sponsored advanced persistent threats but could encompass a broad set of financially motivated criminal actors. The memo does not give private businesses the full authority sought by "cyber privateer" legislation, a term drawn from 16th-century naval warfare, but it elicited online praise from proponents of that idea.

Since the Trump administration took office in January 2025, two Republican congressmen have introduced legislation calling for cyber privateers to take the fight to foreign hackers. The new memorandum does not enact those bills into law, but it moves in the same direction. Private corporations have long worked with the federal government to disrupt cybercriminals, but largely as contractors fulfilling a support role rather than as lead actors in offensive operations. By contrast, this program would allow private businesses to conduct disruption or intelligence gathering directly against government-selected targets abroad.

For the cybersecurity and government contracting industries, the memorandum raises immediate commercial questions. Companies with offensive cyber capabilities — including incident response firms, threat intelligence vendors, and specialized government contractors — would need to assess whether participation is commercially viable given legal uncertainty, reputational risk, and the possibility of retaliatory attacks. The requirement to be a federal contractor may favor established defense and intelligence contractors with existing clearance infrastructure, but it could also open a new market for smaller firms that develop exploit tools or disrupt botnets. Yet no company has publicly stated an intent to participate, and the administration has not identified which agencies would oversee the program or how targets would be chosen.