Federal officials have started choosing the people who will decide which private U.S. firms get to hack foreign cybercriminals on the government's behalf, but nobody has yet settled how those firms get paid or who answers for an operation that goes wrong. The U.S. has begun selecting managers to oversee the program created by an August presidential memorandum, a former official and two other people with knowledge of the discussions told Nextgov/FCW on Oct. 15. It is unclear who is under consideration for the roles or whether the government intends to fill them with existing federal officials.
The memorandum, titled "Expanding Capabilities to Combat Transnational Cyber-Enabled Crime" and dated Aug. 12, 2026, sets the policy plainly: "Thus, it is the policy of the United States to use all instruments of national power, including the innovative capabilities of the private sector, to combat cybercrime."
How the NCC Offensive Cyber Program Is Built
The memo directs the National Coordination Center (NCC) to create, manage and maintain a Program that authorizes "Participating Companies" to conduct Cyber Surveillance Operations and Cyber Effects Operations against foreign Cyber-Enabled Transnational Criminal Organizations, or CE-TCOs, "under the control and oversight of the Federal Government."
Two co-Executive Directors run it: one from the Justice Department, designated by the Attorney General, and one from the Department of Homeland Security, designated by the Secretary of Homeland Security. Nextgov/FCW says only that "managers" are being selected; neither source names these posts. The directors may approve operations after coordinating with each other, but they may not approve any operation resulting in "Critical Outcomes," which the memo defines as actions likely to cause loss of life or serious injury, or to rise to the level of use of force or armed attack under international law.
Companies get into the Program through contracts. Each Participating Company must sign a contractual agreement with DOJ or DHS that ensures it undergoes rigorous vetting. Firms may also sign commercial agreements with private-sector entities, which can pass along threat information collected in their normal business, and with federal, state, local, tribal and territorial agencies that identify CE-TCO threats. Companies must disclose all of those relationships to the NCC.
The memo excludes groups tied to a foreign government, but it tells officials to assume a group is not an institutional part of a foreign government "unless clear intelligence exists establishing such connection." Nextgov/FCW noted that the distinction can be hard to draw in Russia, where intelligence services have tolerated, protected or recruited criminal hackers. The former official said that ambiguity would put considerable pressure on the managers approving missions.
What the $1 Million Bond and Vetting Rules Require
Section 3 of the memo gave the Program Executive Directors 60 days, a deadline that fell around Oct. 11, to write operating procedures with the Homeland Security Council. Those procedures must set minimum standards covering technical proficiency, proven performance of cyber operations, facility security and personnel vetting. The eligibility criteria must enable participation by "both large companies, which provide critical capacity, and smaller, more agile companies, which may be better suited for specialized or discrete tasks."
The memo also authorizes DOJ and DHS to require, as a contract condition, that companies "maintain a bond or escrow in an amount not less than $1 million, to be forfeited should the Participating Company enter non‑compliance" with its agreement. Every company faces review for continued participation at least annually, and the directors must review every cyber operations package and give written approval before a firm takes action. A firm that finds its operation unintentionally hitting a U.S. person or a system inside the United States must stop, minimize and notify the NCC immediately.
A status report on the Program is due to the Homeland Security Advisor and the National Cyber Director within 180 days of the memo, around Feb. 8, 2027, and annually after that. Neither source says whether the operating procedures have been completed.
Who Pays the Hackers, and Who Is Liable When They Miss?
The memo carries the standard clause that it "shall be implemented consistent with applicable law and subject to the availability of appropriations," and it creates no enforceable rights. The former official noted that issuing a presidential memorandum does not itself provide money to carry out its instructions.
"Who’s paying for this to be done, and what’s the financial incentive for any of these offensive cyber companies to actually do this?" the former official said.
Officials are exploring payment based on the success of operations, according to the former official, but the mechanics remain unresolved. Stolen cryptocurrency recovered in an operation may need to go back to victims, which limits what could fund the firms that helped recover it.
Liability is the second open question. One person familiar with the talks said companies need clarity about their exposure if they strike the wrong target, exceed an approved mission or damage systems belonging to someone other than the criminals. Cybercriminals route activity through compromised routers and other equipment owned by innocent businesses, and disrupting that infrastructure could require coordination with the FBI and foreign authorities, including countries unwilling to cooperate. The same person said the government would also need to consider protecting firms and employees from retaliation, including physical threats.
"It is potentially a transformative approach that imposes cost on the adversary, creating a new form of deterrence, but it’s critical that liability, authorities, and international coordination be sorted out," Snehal Antani, CEO of Horizon3.ai, told Nextgov/FCW.
From "Not Talking About" Offense to Hiring It
The memo builds on Executive Order 14390 of March 6, 2026, on combating cybercrime, fraud and predatory schemes against American citizens. The administration's March cybersecurity strategy called for closer collaboration with industry to disrupt enemy hackers. Shortly after that strategy's release, National Cyber Director Sean Cairncross said he was "not talking about private sector, industry or companies engaged in a cyber offensive campaign." Five months later, the White House signed a memo that creates exactly that kind of contracted role.
What It Means for Contractors
Cyber firms weighing this work should treat it as a DOJ or DHS contract vehicle; neither source mentions a solicitation or a funding line. Exposure points are visible: a possible bond or escrow of at least $1 million at risk on any non-compliance, annual re-vetting, facility and personnel security requirements, and written approval for every operation. Smaller specialized shops have an explicit opening, since the memo requires eligibility criteria that accommodate them alongside large firms.
The commercial side matters too. Companies may contract with private clients to receive threat data and with state and local agencies, all of which must be disclosed to the NCC. Until the government decides how compensation works and how far a firm's liability extends when an operation damages a third party's system, firms have no clear basis for pricing the work. Watch for the operating procedures, the named Executive Directors and any appropriations language; the 180-day status report due around February 2027 is the next fixed checkpoint.
