White House Cybercrime Memo: Operational Secrets Need Their Own Channel

A new White House memorandum directs the U.S. government to create a program in which vetted American companies can conduct cyber surveillance and disruptive cyber operations against foreign cyber-enabled criminal organizations. The companies would act under federal direction, control and legal authority—not under a general license for private organizations to hack back.

That distinction is central. The memorandum lays out a controlled government program, but many of the details that will determine its safety and accountability still have to be written. It also creates a difficult information-handling problem: private contractors and public agencies will need to exchange highly sensitive target intelligence, credentials and operational instructions without turning ordinary collaboration systems into permanent repositories of those secrets.

What the memorandum actually creates

Published on August 12, the National Security Presidential Memorandum instructs the National Coordination Center to create, manage and maintain the program. Two executive directors—one designated by the Department of Justice and one by the Department of Homeland Security—will oversee it.

Participating companies must be U.S. companies accepted into the program. They must sign contracts with Justice or Homeland Security, undergo rigorous vetting and follow operating procedures that the government is required to establish within 60 days. The memorandum says every cyber-operations package must receive written approval and direction before a participating company acts.

The program covers two defined categories. A Cyber Surveillance Operation is intended to collect information or intelligence, including through access that the system owner did not authorize. A Cyber Effects Operation can manipulate, disrupt, deny, degrade or destroy information systems, networks, infrastructure or information. Those are the memorandum's definitions; they do not mean that any particular operation has already been approved or conducted.

This is not a blanket “hack back” permission

The text repeatedly places participating companies under federal control and oversight. It says program activity must comply with the U.S. Constitution, applicable law—including 18 U.S.C. § 1030—and U.S. international obligations. CyberScoop and BankInfoSecurity both describe the policy as a major expansion of the private sector's role while noting that it stops short of simply legalizing private hack back.

The memorandum requires operational deconfliction across law-enforcement, diplomatic, defense, treasury and intelligence bodies. If an operation exceeds its approved scope and reaches a U.S. person, a U.S.-based system or a system controlled by a U.S. person, the participating company must stop, minimize the collected information and immediately notify the National Coordination Center. The two program directors also may not approve an action likely to cause death or serious injury, or to reach the level of a use of force or armed attack under international law.

Companies may be required to maintain a bond or escrow of at least $1 million that can be forfeited for contractual noncompliance. That is a financial control, not proof that an operation is technically safe, legally valid in every affected jurisdiction or immune from unintended consequences.

What remains unknown

The public memorandum does not name participating companies, targets or approved operations. It does not publish the technical access controls, evidence standards, retention periods or incident-response procedures that contractors will use. A classified annex contains part of the operational workflow and deconfliction framework, so outsiders cannot assess the complete design.

The 60-day implementation guidance will therefore matter as much as the announcement. It must translate high-level requirements into target validation, authorization, compartmentalization, monitoring, stop conditions, evidence preservation and post-operation review. The first status report is due within 180 days, with annual reports after that, but the memorandum does not promise that those reports will be public.

The overlooked risk: the operation around the operation

A cyber operation is surrounded by sensitive artifacts: target packages, infrastructure details, collection results, access credentials, API tokens, private keys, recovery codes, legal approvals and emergency stop instructions. If those values are pasted into email, chat or a long-lived ticket, the collaboration layer becomes another attack surface.

Encryption at rest does not solve uncontrolled copying. A message can be forwarded, an inbox can be delegated, a ticket can be exported and a contractor account can outlive the assignment. The safer design separates the durable record—who approved what, for which purpose and for how long—from the reusable secret that enables access.

A safer handoff pattern for participating teams

Verify the recipient and authorization separately. A familiar display name or an urgent request in the operation channel is not sufficient. Confirm the person, role, operation identifier and current approval through an independent trusted path.
Reduce the secret before sending it. Create a credential limited to the approved target, action and time window. Do not hand over a standing administrator password when a scoped token can do the job.
Keep plaintext out of the case record. Store the approval, owner, purpose, issue time and revocation event in the official system. Transfer the value through a separate encrypted, expiring, one-time channel.
Bind access to stop conditions. Short expiry, explicit revocation and rapid rotation should match the operational window. If scope drifts or an unintended system is reached, access should be removable without waiting for every recipient to respond.
Minimize outputs too. Collection results can be more sensitive than the credential used to obtain them. Share the smallest necessary extract, redact unrelated identities and apply the authorized retention schedule.
Close the loop. Confirm receipt, revoke the credential, invalidate sessions where appropriate and record completion without copying the secret back into the audit trail.

Where Secretus fits—and where it does not

Secretus can help with a narrow operational need: transferring an ad-hoc credential or recovery value through an encrypted, expiring link rather than leaving plaintext in an ordinary collaboration channel. It can reduce durable copies and give the sender a clear expiration boundary.

It does not authorize an operation, verify a target, protect a compromised endpoint or replace a privileged-access-management system. Secretus is not presented as an approved system for classified information or as satisfying government contracting requirements. Any participating company must use the systems, controls and handling rules formally approved for its contract and data classification.

What security leaders should do now

Do not interpret the memorandum as permission for independent retaliatory hacking.
Watch the 60-day implementation guidance for eligibility, authorization and handling requirements.
Map where operational credentials and target intelligence can persist across contractors and agencies.
Separate approvals and audit evidence from the plaintext secrets used to execute them.
Require scoped access, two-person review for high-impact actions and tested emergency revocation.
Document how unintended collection will be stopped, minimized, reported and deleted.

The headline is an expansion of U.S. offensive cyber capacity. The implementation test is whether authority, target scope and operational secrets remain controlled when government and private teams move quickly together.