People Operations Partner

Trump's move to 'unleash' private sector hackers raises novel oversight, liability questions. The goal is to let private companies take on foreign cyber criminals, but the unprecedented approach raises plenty of questions about oversight and liability. August 14, 2026 6:33 pm President Donald Trump's order to "unleash" the private sector to conduct offensive cyber operations against foreign criminal hackers is raising novel questions about government oversight, as well as legal liability and other risks for private companies that enlist in the program. The national security presidential memorandum signed by Trump this week does not enable private sector companies to "hack back" when they face a cyber intrusion. Instead, it establishes a government-run program that will contract with private sector companies and approve any offensive cyber operations conducted by industry participants. The new directive follows the White House's national cyber strategy, released in March, which says the Trump administration will "unleash the private sector by creating incentives to identify and disrupt adversary networks and scale our national capabilities." Trump's memo directs the National Coordination Center to create and manage a program that authorizes companies to take offensive cyber action against "cyber-enabled transnational criminal organizations." The Department of Homeland Security and the Justice Department will each designate a program executive director to co-lead the program. "Cyber operations shall only be approved after coordination between the program executive directors, and any resulting operational action will be exclusively conducted on behalf of and under the supervision of the federal government pursuant to the federal government's lawful authorities," the memo states. Tonya Ugoretz, former assistant director of intelligence at the FBI's directorate of intelligence, said the directive is "a novel approach to what's proved to be an intractable problem of cyber-enabled crime that we know affects every U.S. citizen to the tune of billions of dollars per year." Ugoretz is currently the leader of PwC's Cyber & Risk Innovation Institute. "These cybercriminal groups have proven to be resilient, and they bounce back inevitably after even the best, most sophisticated, well-organized disruptions that the government brings to bear," Ugoretz told Federal News Network. "I think this memo is a step towards taking an out-of-the-box approach to say, how can the government add additional capabilities to its arsenal?" Lyn Brown, a former senior attorney at the FBI and partner at Wiley Rein, says the memo is "kind of a natural extension" of Trump's 2018 policy that streamlined approval for military cyber operations. "This is recognizing some of the unique capabilities and access that the private sector has, and trying to leverage that and expand the fight against transnational organized crime to a broader degree," Brown said in an interview. Gary Barlet, a former federal chief information officer and public sector chief technology officer at Illumio, said the new approach recognizes that other nations have relied on criminal groups and other third parties to execute cyber attacks. "The reality is that the private sector has access to more talent and resources and not necessarily the same constraints," Barlet said. "We've already seen successful examples of this, like a big tech enterprise going after cyber domains that were involved in ransomware attacks." Government oversight and deconfliction. The landmark program, however, faces plenty of questions surrounding its implementation. Ugoretz said a key area to watch will be the resourcing of the National Coordination Center, a relatively new entity that was established to coordinate the activities of Federal Homeland Security Task Forces created by an immigration-focused Jan. 20, 2025, executive order. "Is it 24/7? Is it staffed with people with enough cyber and cyber operations expertise? That's where having an integrated entity like that can be challenging," said Ugoretz, who served as the first director of the Cyber Threat Intelligence Integration Center. "When you're standing up entities like that in the government, you're often not adding net new personnel and expertise," Ugoretz continued. "You're borrowing and pulling from the limited resources and expertise that already exists in various government agencies, which then has an impact on those agencies you're pulling from." The center's resourcing and other issues may be addressed by a classified annex to Trump's memo. The new approach also raises questions about how government agencies with classified intelligence will coordinate with the new private sector participants. "I imagine from a security standpoint, that the disclosures of sensitive intelligence to the private sector will be relatively narrow in scope for security reasons," Brown said. "But there's going to have to be some level of sharing for the government to be able to supervise and direct, and the private sector to be able to effectively carry out these kinds of operations against the targets that are selected." The memo also directs officials to establish "operational deconfliction" across federal law enforcement, the State Department, the Treasury Department, the Defense Department, DoJ and the intelligence community. The effort to deconflict operations is a "good signal," Ugoretz said, given the potential for private sector hacking to clash with other operations in cyberspace and beyond. But she added that even after decades of experience, it's still difficult for government leaders to deconflict cyber operations and keep pace with fast-moving adversaries. "I don't know that they've cracked it yet," Ugoretz said. "And that's through no fault of their own. It's hard. There are so many agencies with so many different equities. Now you're adding private companies who need to be coordinated with and deconflicted. That's an additional level of complexity, but it's a real opportunity to address a challenge that's been longstanding, because adversaries are not using static infrastructure. They're shifting constantly to stay a step or two ahead of any disruption operations." Gray areas for the private sector. While the public part of the memo goes into detail on government oversight mechanisms, the risks and liabilities for private sector participants are less clear. Trump's memo requires companies to enter into contractual agreements with DoJ and DHS to participate in the program. The agreements are aimed at ensuring the companies undergo "rigorous vetting and that their performance adheres to... strict operational procedures," the memo adds. The memo also allows those companies directly participating in the program to enter into commercial agreements with other firms that may have access to "threat information." Ugoretz pointed out that the memo doesn't directly address legal liability for private sector companies and the implications of laws that make hacking illegal - such as the Computer Fraud and Abuse Act - even if they're nominally operating under U.S. government oversight and supervision. "I think that will be front and center as companies decide whether and how much they want to participate," Ugoretz said. Brown said the contractual agreements will be "key" as DHS and DoJ develop the program. "I would hope there will be robust dialog so that the private sector can articulate to the government what it is that they're seeking in terms of potential liability protection or indemnification, along with the government's probable desire to have some kind of standardized template agreements for efficiency's sake and for uniformity's sake," Brown said. Barlet said the program also raises novel questions, such as whether private sector companies that participate in the program will be considered legitimate targets by foreign countries. "Some would argue they are already in the crosshairs, so giving them a path to fight back makes sense," Barlet said. "The potential benefits outweigh the risks, but we need to go into this eyes wide open - there will be friction, gray areas, and unintended consequences we can't fully predict yet." In addition to facing reprisal from foreign hackers, companies that contribute to the program could face "customer trust" issues by participating in or informing offensive cyber operations, Ugoretz said. "There's a lot for companies to weigh either when they're thinking about participating, providing data that enables the participants, or just being adjacent to this whole new ecosystem," she said. Justin Doubleday covers cybersecurity, homeland security and the intelligence community for Federal News Network. Related Topics

The Expert View: AI has changed the attack, but the basics still decide the defence. Artificial intelligence has shifted the balance between attackers and defenders in cyber-security, yet the strongest defences are still built on fundamentals. That was the message at a TEISS dinner briefing at the House of Lords, hosted by Illumio. Attendees, all CISOs and senior security leaders from multiple sectors, discussed how to prepare for AI-driven attacks, manage third-party risk and limit the damage when an attacker gets in. Since Anthropic announced its Mythos model, guidance on how organisations should prepare has been strikingly consistent, said Raghu Nandakumara, VP Industry Strategy at Illumio: improve resilience; limit the blast radius of any breach; focus on basic controls. Japanese banking leaders told him the previous week that their equivalent of Britain's financial services regulators (FCA / PRA) had issued nine requirements and asked to see progress. The question he put to the room: is the AI threat hype or reality? A threat that may already be inside Attendees saw plenty of evidence for the reality of the threat. Microsoft's monthly patch update for July 2026 was 10 times its usual size, one attendee noted, the start of a Mythos-driven "patch wave". Mythos itself, another attendee said, is a powerful tool that deserves attention. China dominated the discussion of state threats. Chinese actors have been on Western networks for decades, one participant said; the worry is that AI makes that presence harder to detect or enables China to act faster. For critical national infrastructure the fear is of being shut down, perhaps during a conflict. What if these technologies are already in your systems, one attendee asked. Are Teiss prepared for that? You cannot defend what you cannot identify, another participant answered, and many organisations still lack a clear picture of what their IT estates consist of. For years patching and upgrades lost out to business-as-usual priorities, and the funding to put that right is hard to secure. The AI hype has had one welcome effect, several agreed: boards are paying more attention to security, an opening to get basic cyber-hygiene in place everywhere. Regulators offered little help. They come to Teiss for information, one attendee said, describing them as not one step behind but 10. Useful intelligence came instead from the NCSC and industry contacts. The third-party problem Even securing your own systems might not be enough, attendees agreed, because attackers can enter via third parties. Securing those can be complicated: niche suppliers are often not IT specialists; may be the only source of something the business needs; and pass the cost of any mitigation back to the customer. With tens of thousands of suppliers of all sizes, enforcement is close to impossible. Companies can issue questionnaires, but these are only ever a snapshot. Liability clauses in contracts offer some protection, though these require negotiation and usually will land on some form of mutual liability. Onerous clauses raise the barrier to entry too high for smaller suppliers, and nobody could sign up to unlimited liability for an incident on the scale of Jaguar Land Rover's. Nandakumara said Illumio's customers now consistently ask them 3 questions: how are you leveraing frontier AI to ensure you deliver more secure products; how are you helping your customers address the risks of fronter AI; how are the developments in frontier AI shaping your roadmap? Assume breach, limit the blast radius Beneath much of the evening ran a mindset shift, begun by cloud adoption and hurried along by AI: senior leaders now accept that not every attack can be prevented, and that cloud has multiplied the attack vectors. The practical questions become how to keep the business running, whatever the cause of the impact - and how to recover fast. Jade Puffer, ransomware designed and deployed by AI, has made disruption trivially easy, one participant warned. Attendees discussed defining a maximum acceptable blast radius. That starts with understanding every asset and access point on the estate, then working out how to contain an intrusion within tolerable limits. The exercise must be revisited as the environment changes, and dependencies need particular care: disruption to one system can unexpectedly extend the blast radius to others. Insider threat gets the same treatment: assume there is one, and rely on segmentation and controls on lateral movement to limit what it can reach. Keeping senior stakeholders engaged means putting all of this in business terms. One attendee said that whenever they spot a threat that could change how the company does business, they propose a tabletop exercise so stakeholders can watch the consequences unfold. AI's new risk surface Attendees wanted to use AI to defend against AI, similar to how DevSecOps has embedded security in development. But confidence is elusive. If AI is protecting you, how do you know it is working? Many organisations cannot even map what AI is in their systems. New risks are stacking up, attendees said. Some organisations are too comfortable with the assumed security of on-premises AI - as agents multiply, assuring their identity becomes a problem and staff are urged to use AI without training or instruction, so well-intentioned use exposes the business to greater risk. AI companies should do more to help organisations manage all of this, attendees argued. Governance must be real, too: are you doing what your paperwork says you are, and do the people making decisions understand the risk appetite? Closing the discussion, Nandakumara set the AI question aside. Assume attackers will find a way in, he said, emphasising that businesses should focus on foundational security controls, and ensure you can contain the spread and impact of the breach. Sponsored by Illumio

Check Point Software Technologies and Illumio have expanded their partnership to defend against AI-powered cyberattacks that can execute full-scale attacks autonomously at machine speed. The collaboration combines Check Point's perimeter defence with Illumio's breach containment capabilities. The partnership addresses frontier AI models that compress the entire attack lifecycle into single automated sequences. Check Point prevents threats at network boundaries, whilst Illumio provides workload visibility and microsegmentation to contain breaches that penetrate defences. Building on their 2025 integration, the expanded partnership now includes deep integration with Illumio Segmentation, allowing security teams to align firewall policies across hybrid and multi-cloud environments. Customers can now procure Illumio directly through Check Point, simplifying vendor consolidation. IDC forecasts microsegmentation to grow at 23.5% CAGR, with 98.3% of buyers preferring solutions integrated with SASE and firewall technologies.