US takes risky bet on private 'pirates' to combat cybercrime

The United States has approved a novel approach to combating cybercrime by allowing private companies to engage in hacking activities against foreign cybercriminal groups. President Donald Trump signed a memorandum on Wednesday, directing the Departments of Justice and Homeland Security to authorize certain US companies to spy on and attack transnational criminal organizations. This unprecedented measure has sparked debate among experts, who believe it could be effective or result in uncontrollable consequences.

The White House justifies the approach by highlighting the significant damages caused by ransomware, sextortion, and online fraud, which cost American citizens over $20 billion in 2025. The memorandum permits private partners to take down hackers' servers or infiltrate their machines with spyware. Each operation requires prior government approval, and companies must post a bond of at least $1 million.

Actions that could result in death or injury, as well as any activity that would be considered excessive use of force under international law, are strictly prohibited.

This initiative draws parallels to the historical practice of privateering, where governments authorized private ships or sailors to raid enemy vessels during the 18th century. The new program aims to combine the data held by the private sector with the authorities of the public sector, bridging the gap created by a lack of oversight that previously existed.

Former federal prosecutor and TRM Labs head Ari Redbord compares the current situation to maritime privateering, emphasizing the need for increased oversight due to the significant differences in today's world.

However, not all experts are convinced by this approach. University of Surrey cybersecurity professor Alan Woodward warns that handing out commissions and expecting obedience is not guaranteed success, as history has shown that privateering often proved more trouble than it was worth. Others argue that this U-turn in the White House's stance on the issue may be due to a systemic weakening of oversight organizations, such as the Office of the Director of National Intelligence.

While the program includes certain safeguards, such as the exclusion of actions causing death or injury and adherence to international law, concerns remain about the lack of judicial oversight. Tech giants like Microsoft and Google could potentially benefit from this new program by expanding their cybersecurity efforts and operating without judicial oversight under government control.

However, this could also make them targets themselves, as Woodward points out. The Trump administration has 60 days to finalize the program's details, though some aspects will remain classified. The ultimate success or failure of this initiative remains uncertain, as the administration must weigh the potential costs against the benefits of tackling cybercrimes.