US moves to staff leaders for industry-partnered offensive cyber program

MalBot · October 15, 2026, 3:20pm

The U.S. has begun the process of selecting managers to oversee a new program enlisting private companies in operations against foreign cybercriminals, according to a former official and two other people with knowledge of the discussions.

Introduction to Malware Binary Triage (IMBT) Course

Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.

Enroll Now and Save 10%: Coupon Code MWNEWS10

Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.

The effort marks an early step toward implementing the initiative unveiled in August. But significant questions remain about how to pay participating firms and who would bear responsibility if their operations cause unintended harm, the former official and one of the people said.

All three sources were granted anonymity to share details of sensitive government discussions. It is unclear who is under consideration for the management roles or whether the government intends to fill them with existing federal officials.

The<a href=“Expanding Capabilities to Combat Transnational Cyber-Enabled Crime – The White House”> program</a> allows vetted U.S. companies to gather intelligence on and disrupt systems used by foreign criminal hacker groups. Firms would operate under Justice Department or Department of Homeland Security contracts, with written approval for each mission.<a href=“Expanding Capabilities to Combat Transnational Cyber-Enabled Crime – The White House”> </a>

The developments mark a key step toward putting that policy into practice. But the conversations described by the sources highlight how much remains to be settled before companies can undertake the work.

The former official said the government is still working out how to fund the effort and compensate companies. Issuing a presidential memorandum does not itself provide money to carry out its instructions, the former official noted.

“Who’s paying for this to be done, and what’s the financial incentive for any of these offensive cyber companies to actually do this?” the former official said.

Officials crafting the framework are exploring whether companies could be paid based on the success of their operations, but how those payments would work remains unresolved, the former official added. For example, stolen cryptocurrency recovered during an operation may need to be returned to victims, limiting what could be used to pay the companies that helped recover it.

One of the people familiar said companies also need clarity about their exposure if they strike the wrong target, exceed an approved mission or damage systems belonging to someone other than the criminals they are pursuing.

Cybercriminals can route their activity through compromised routers and other equipment belonging to innocent businesses, the person said. Disrupting that infrastructure could require coordination with the FBI and authorities in other countries, including places unwilling to cooperate with U.S. operations.

The U.S. for years has conducted cyber operations, gathered intelligence on foreign hackers and used court orders to dismantle criminal networks, often with technical assistance from private companies. Those activities draw on different legal frameworks, including bedrock <a href=“10 U.S. Code Subtitle A Chapter 21 Subchapter I Part I - GENERAL MATTERS | U.S. Code | US Law | LII / Legal Information Institute”>Title 10 authorities</a> that underpin military operations and spying.

Firms also regularly help the government investigate and disrupt cyber threats.

CrowdStrike recently<a href=“FBI disrupts North Korean ‘laptop farm’ used to infiltrate US companies - Nextgov/FCW”> provided intelligence</a> for an FBI operation targeting “laptop farms” that allowed North Korean operatives to pose as American remote workers. The White House argues that making greater use of industry’s capabilities under the new directive will help the government pursue those groups faster and on a greater scale.

The former official said managers reviewing proposed missions would have to navigate overlapping law enforcement and intelligence interests. In a hypothetical case, a mission intended to disrupt criminals could interfere with another spy agency’s investigation or access to a network.

Identifying eligible targets presents another challenge. The memo excludes groups that are directly tied to a foreign government, but instructs officials to assume otherwise unless clear intelligence establishes that connection.

As Nextgov/FCW<a href=“The Russian hurdle in Trump’s new offensive cyber program - Nextgov/FCW”> previously reported</a>, that distinction can be difficult to make in Russia, where intelligence services have tolerated, protected or recruited criminal hackers without maintaining full control over their activities. The former official said that ambiguity would place considerable pressure on the managers approving missions.

Participating firms could also become targets themselves. The government would need to consider how to protect companies and their employees from retaliation, including physical threats from criminal organizations, one of the people familiar said.

The initiative has drawn significant attention from industry leaders that have zeroed in on military and intelligence agency demands for exquisite hacking tools and similar innovations that could give the U.S. a leg up in cyberspace.

“It is potentially a transformative approach that imposes cost on the adversary, creating a new form of deterrence, but it’s critical that liability, authorities, and international coordination be sorted out,” Snehal Antani, the CEO of Horizon3.ai, told Nextgov/FCW when asked about the program.

The Trump administration has spent much of the last year defining how private companies would fit into its push for more aggressive cyber operations. Its March <a href=“Trump’s new cyber strategy details more offensive response to cyber threats - Nextgov/FCW”>cybersecurity strategy</a> called for closer collaboration with industry to disrupt enemy hackers.

But officials’ public remarks on the role companies would have in the efforts have considerably shifted. National Cyber Director Sean Cairncross<a href=“National cyber director doesn’t envision industry doing offensive hacking - Nextgov/FCW”> said shortly after the strategy’s release</a> that he was “not talking about private sector, industry or companies engaged in a cyber offensive campaign.”

Some executives, nevertheless,<a href=“US push to counter hackers draws industry deeper into offensive cyber debate - Nextgov/FCW”> </a>expected agencies to eventually <a href=“US push to counter hackers draws industry deeper into offensive cyber debate - Nextgov/FCW”>hire companies</a> to carry out offensive operations.

Article Link: US moves to staff leaders for industry-partnered offensive cyber program - Nextgov/FCW