The Trump administration is opening a new front against cybercrime, allowing private companies to hack back, albeit with Washington firmly holding the leash.

A presidential memorandum signed on August 12 directs the National Coordination Center (NCC) to establish a program allowing vetted American firms to conduct cyber operations against foreign transnational criminal organizations. The initiative expands on a March executive order encouraging greater private-sector involvement in combating online fraud and cybercrime.

Participating companies may undertake two types of missions. “Cyber Surveillance Operations” will permit covert access to foreign computer systems for intelligence gathering. More aggressive “Cyber Effects Operations” could manipulate, disrupt, degrade or even destroy digital systems and infrastructure.

Federal control: The latitude is striking, but not unlimited. Companies will operate under federal authority rather than as freelance cyber-privateers. Officials from the Departments of Justice and Homeland Security must review every proposed operation and provide written approval before it proceeds. Actions likely to cause death or serious injury, or amount to a use of force or armed attack under international law, are designated “Critical Outcomes” and cannot be authorized through the program’s ordinary approval process.

Operational safeguards: Safeguards also require companies to stop operations and notify officials if they inadvertently target Americans or American-controlled systems. Participants must report imminent threats to critical infrastructure and will face rigorous technical, personnel and security vetting. The government may also require firms to maintain at least $1m in bonds or escrow that can be forfeited for contractual non-compliance.

The administration argues that America’s technology industry provides an offensive cyber advantage that has long been underused. The program will test whether that advantage can be harnessed without blurring the already delicate boundary between private enterprise and state cyberwarfare.