The White House Wants Companies to Hack Back

A White House memorandum proposes letting private companies spy on or sabotage designated foreign cybercriminals, according to NPR. The proposal could add corporate personnel and technical access to US cyber defense, but the memorandum reportedly leaves basic operational questions unresolved: who selects a target, who approves an action and what happens when the target is wrong.

The strongest argument for the plan is practical. Companies often see malicious traffic before government agencies do, employ specialists who understand the affected systems and can move faster than an interagency process. Against a persistent foreign criminal network, waiting for every federal gear to engage can mean accepting another intrusion.

The authorization is not the operation

Yet “hack back” describes an outcome more neatly than the work required to produce it. Analysts must attribute an attack, lawyers must define the permitted response, operators must separate criminal infrastructure from innocent machines, and supervisors must decide when surveillance becomes sabotage. Automation may sort signals. It does not absorb responsibility for the choice.

That concealed labor matters because attribution is rarely a name tag pinned to a server. Attackers route activity through compromised systems, rent infrastructure and imitate rivals. A company acting quickly may have useful evidence, but it also has an incentive to protect customers, restore confidence and demonstrate that its security contract can produce more than a report.

Who carries the mistake?

The incentive map does not end with the operator. Contractors can sell offensive capacity. Government officials can gain reach without building the same capacity inside the state. Insurers will want to know whether losses caused during an authorized operation are covered, excluded or transferred to the public. Each participant can support action while expecting somebody else to hold the liability.

Strict rules would not eliminate those conflicts, but they could expose them. A workable policy would need a demanding attribution standard, named approval authority, evidence-preservation requirements, limits on permissible disruption and a clear route for compensating an innocent network owner. Without those provisions, oversight becomes an archaeological project conducted after the outage.

If the White House supplies enforceable limits and keeps human decision-makers visible, private operations may become a narrow supplement to public cyber defense. If it supplies only permission, the likelier result is a wider state reach with a blurred signature—and the first serious mistake will reveal who was acting in the government’s name only after someone else’s system has paid for it.