Trump’s Hack-Back Memo Isn’t a License for Cyber Vigilantes, Crypto Lawyers Say

On DEX in the City, a former government lawyer and a crypto podcaster argued a barely-noticed White House memo deputizing private firms to fight foreign hackers is tightly supervised, and may be exactly what crypto needs.

A White House memo that lets private companies go on the cyber offensive against foreign criminals could reshape how crypto firms fight back against hackers, and, according to two crypto lawyers, it is far more tightly supervised than its early framing suggested.

On the Aug. 18 episode of DEX in the City, host Jessi Brooks, general counsel of Ribbit Capital, was joined by Jane Khodarkovsky, a financial integrity and sanctions expert who previously worked in government, and Jacob Robinson, host of the Law of Code podcast, to work through the presidential memorandum President Donald Trump signed on Aug. 12.

Under the memo, a new National Coordination Center would stand up a program letting vetted private U.S. firms pursue foreign criminal hacking groups online, running both surveillance and disruptive “cyber effects” operations with the government approving and supervising each one. Foreign state hackers, and groups working at a government’s direction, are carved out. Legal analysts and press accounts have called it the first U.S. authorization of private-sector offensive cyber operations.

‘Agents of the Government,’ Not Free Agents

Much of the early reaction, Khodarkovsky said on the show, assumed the memo would let private companies “do whatever they want” against hackers. She pushed back on that read, arguing the program will not work that way because it requires participants to be “overseen by the government,” she said. The bottom line: “they’re going to be agents of the government,” she claimed.

That accountability is written into the program’s mechanics. The memo requires each participating company to post a bond or escrow of at least $1 million, forfeitable if it breaks its agreement; gives two program executive directors, one from the Justice Department and one from the Department of Homeland Security, control over approvals; and bars operations the government judges likely to cause “loss of life or serious injury” or to rise to the level of “use of force” under international law. Khodarkovsky noted that the program also builds in ongoing review: “part of the 60-day period is to have processes and procedures, and then every year they’re going to have to assess whether or not the companies are adhering to the processes and procedures.”

The memo, she argued, is not “focused on sort of vigilante justice of you can do whatever you want” simply because an attack is being prevented. She drew that from the document’s own language, which requires companies to comply with U.S. and international law and to obtain authorization before acting against U.S. persons or systems.

A Modern ‘Letter of Marque’

Robinson went further, casting the program as a long-overdue tool for crypto. He compared it to privateering, the centuries-old practice of governments authorizing private ships to attack enemies at sea, and said the industry needs its digital equivalent. He said on the show that issuing “cyber letters of marque” would let vetted operators go after criminals “especially on blockchains” to help “combat some of the crime,” calling it “a huge, huge step in the right direction” if the details are done right.

His case rested on a problem crypto knows well: speed. When a protocol is drained, the people best positioned to respond are private, but they have little legal cover to act. Robinson pointed to the roughly $280 million Drift Protocol exploit earlier this year, in which much of the stolen money moved as Circle’s USDC. “People were clamoring for Circle to freeze it,” he said, but “Circle takes on a big risk when they do something like that without a court order, without a mandate from the government.” A framework that deputizes and legally protects private responders, he argued, could close that gap.

The Details Will Decide

Brooks was more skeptical. She agreed that pulling in the private sector is “probably a good one” as a concept but warned that “the devil’s gonna be in the details.” Her worry is oversight capacity: without enough technical experts inside the government to supervise the program, “otherwise it’s just people out there hacking,” she said. She also noted that the memo does not repeal the Computer Fraud and Abuse Act, the federal anti-hacking statute, so the legal bounds on what deputized companies can actually do remain to be spelled out.

All three flagged how much is still unwritten. Operating procedures are due within 60 days and a program status report within 180 days, and a classified annex governing how intelligence agencies share information with private companies, Khodarkovsky noted, could prove as consequential as the public text.

Related Listen: DEX in the City: The CFTC’s Kalshi Rescue and the Limits of Emergency Power