The Bond and the Vetting
The federal government has spent decades telling private companies that hacking back is illegal. It just started handing out exceptions.
Start with the memorandum itself. On August twelfth, the President signed a National Security Presidential Memorandum titled Expanding Capabilities to Combat Transnational Cyber-Enabled Crime. It directs the National Coordination Center to build a program authorizing private American companies to conduct two things: cyber surveillance operations, and cyber effects operations — the second of which means breaking into and disrupting somebody else’s systems. The targets are foreign criminal organizations running ransomware, financial fraud, and the scam compounds behind pig butchering. The reporting is consistent across CyberScoop, The Register, and TechCrunch, all three working from the memo and an accompanying White House fact sheet.
Now the qualifications, because they are specific. A company has to sign a contract with either the Justice Department or the Department of Homeland Security. It has to clear vetting on technical proficiency, on facility security, and on personnel reliability. It has to disclose every outside contractual relationship tied to the program. It has to post a bond or escrow of at least one million dollars, which it forfeits if it falls out of compliance. It gets evaluated annually. And before any single operation runs, it needs written approval from two program executive directors, one at Justice, one at Homeland Security. Operating procedures are due within sixty days. And hold onto that bond figure, because a million dollars is the floor, and in federal contracting terms it is close to nothing. It is not there to cover damages. It is there to make sure whoever posts it is a real company with something to lose.
Then set two other numbers beside that.
In a single recent cycle, Microsoft shipped fixes for four hundred twenty-one flaws in one Patch Tuesday, including a Windows zero-day already being exploited. And Microsoft has said why the number keeps climbing: it is running a system of more than a hundred AI agents across its own code, finding defects faster than people ever did, and it has told customers to expect the volume to keep going up. That is one vendor, one month, and the number is rising on purpose.
And the system that keeps track of those flaws is being rebuilt because it cannot keep up. NIST has said it wants to overhaul the National Vulnerability Database — the federal catalog the entire security industry indexes against — specifically for the volume and the pace that AI is bringing to it.
So: a government standing up a licensed capability to go on offense, a defect count that fills a catalog faster than the catalog can be maintained, and a plan to rebuild the catalog rather than reduce what goes into it.
Those three things only fit together one way, and it starts with a question nobody asked out loud: what exactly is being handed out here.
Congress Grants Those
Everything in that program — the bond, the vetting, the annual review, the written approval before a single operation runs — is built around the assumption that the ability to attack is rare and needs to be carefully handed out. That assumption expired.
Around the same time, OpenAI released a model called GPT-5.6-Cyber, built specifically for security work, with its refusal behavior deliberately loosened and a reported ninety-five percent completion rate on advanced cybersecurity tasks. That is a commercial product. And WIRED has been documenting a growing run of incidents where AI agents conduct intrusions on their own — not a person using a tool, but software carrying out the attack chain without anyone directing each step.
So the capability is not scarce. It is purchasable, and in some cases it is already loose.
What remains scarce is permission. And that is the thing the government just started issuing.
Understand what the legal theory here actually is. The reason breaking into a criminal group’s servers has been off the table for private companies is the Computer Fraud and Abuse Act, which turns on authorization. The memo’s answer is that participating companies operate as part of lawful investigatory and protective operations carried out by federal law enforcement — they are acting as the government’s agent, so the access is authorized. That is the entire mechanism. Not new technology. A new legal status. And note what the memo does not do. Earlier proposals to let private companies hack back would have amended the Computer Fraud and Abuse Act outright. This one leaves the statute untouched and requires the program to comply with it. The theory is that the agency relationship makes the access lawful. That theory has never been tested in court.
Which raises the question of who is allowed to grant that status. And the answer is written down.
Article One, Section Eight of the Constitution lists the powers of Congress. Clause eleven reads: to declare War, grant Letters of Marque and Reprisal, and make Rules concerning Captures on Land and Water.
A letter of marque is a government license authorizing a private party to conduct force that would otherwise be a crime. That is the historical instrument, and it is named — explicitly, by name — as a power of the legislature, sitting in the same sentence as the power to declare war.
The framers put licensed private force in Congress’s hands deliberately. And this is not a comparison I am reaching for. People in policy circles have spent years openly calling for cyber letters of marque, by name. That is the thing that was asked for. This is not that.
This was not done by Congress. It was not even done by executive order. It was done by presidential memorandum, which is a thinner instrument still, and it lasts precisely as long as the administration that signed it.
Permission is the scarce good. And it is being rented, not owned.
Which is a fine observation about Washington until you check whose name is on the permissions underneath your own service lines.
Whose Permission Are You On?
Here is where that lands on you, and it is not where you’d expect.
Clear one thing first. You are not the exposed party here. In twenty twenty-one the Supreme Court decided a case called Van Buren, and it read the Computer Fraud and Abuse Act narrowly — the question is whether the gate is up or down for you, not whether you had a good reason for walking through it. If you have credentials and access, using them is not a federal crime. The vulnerability researchers poking at software nobody gave them permission to touch have a real problem with this statute. You do not.
But look at where your permission actually comes from, because it isn’t where most providers assume.
When you check a client’s Microsoft tenant for configuration drift, your client did not authorize that. Your client cannot authorize that. They don’t own the system. Microsoft does, and Microsoft grants your access through the partner program on Microsoft’s terms — and rewrites those terms when it decides to. It already did. Delegated admin privileges used to hand a partner global administrator rights on a client tenant with no expiration. Microsoft killed that model, stopped issuing it for new customers, and for partners who hadn’t moved, automatically created a replacement relationship with eight default roles and stripped the old access thirty days later. Every provider running Microsoft work today runs it on a permission that is role-scoped, time-bound, expires within two years, and gets regranted or doesn’t.
That is not a criticism of Microsoft. The old model was genuinely dangerous. It is an observation about who holds the deed. Your ability to deliver most of what you sell is a permission, granted from above, revocable, on terms you did not negotiate and cannot appeal.
Which is the same sentence as the memorandum. A bonded license to operate, issued by an authority that can withdraw it, sitting on top of a capability the holder already had. The government just made that structure visible at the scale of the state. It has been sitting on your desk the whole time.
So here is the choice. Know whose permission you actually run on — go service line by service line and name the vendor that grants the access underneath each one, and what happens to that line when the terms change. Or keep operating a business whose right to function is a paragraph in somebody else’s agreement that you did not write, did not negotiate, and have never read.
And once you’ve written that list down, it stops being a legal question and becomes a Tuesday morning one.
Because a permission with an expiration date is an operational asset, and in most shops nobody owns it. You already track certificate expiry and license renewals because an outage taught you to once — and the permission underneath each service line has exactly the same property: it expires, it gets rewritten, and you find out from a portal notification somebody may or may not have read. Put it on the same register, with the same named owner and the same review cadence.
What to Consider
Build the register before you need it, and keep it boring. One row per service line, four columns: what you deliver, which vendor grants the access underneath it, what the mechanism is — delegated admin, API key, partner program membership, reseller agreement — and when it expires or can be changed. Most shops can fill this out in an afternoon and have never once been asked to. The value isn’t the document; it’s discovering which two or three lines have no answer in column three.
Put a clock on the permissions that already have one. Granular delegated admin relationships run for a fixed term of up to two years and then stop working unless they’re regranted, and the client can terminate them at any point. That is a scheduled service interruption sitting in your delivery model with no ticket attached to it. Whoever owns your renewals calendar should own these too, on the same cadence, with the same lead time you’d give a certificate.
Make “what changes for us” a standing question in vendor reviews, not a reaction to an announcement. When Microsoft retired the old delegated admin model, partners who hadn’t moved had a replacement relationship created for them and the old access stripped thirty days later. That was well-signposted and it still caught people, because nobody’s job was to read it.
Assign that reading. And widen it, because your security vendors are moving toward you as fast as the terms are. CrowdStrike is now pushing QuiltWorks, its frontier AI risk protection, down into the SMB channel — which means the enterprise security firms whose profile matches everything that new federal program requires are also the firms arriving in your stack. Those two facts are unrelated today. Ask anyway, at renewal, in writing: what are you party to, and what would we be downstream of.
And picture the provider who did this. When the terms change — and they will — that shop already knows which clients are affected, which service lines touch it, and what the remediation costs, on the day of the announcement instead of the day of the outage. They send one email. Everybody else spends a weekend finding out.
If this trend continues, within twelve to eighteen months, the operational risk that takes a provider down won’t be a breach or a failed backup — it’ll be a permission that expired, got rescoped, or got withdrawn on a vendor’s schedule, and the shops that survive it cleanly will be the ones who had a name and a date next to every one of them before it happened.