A Just Security series launched on November 3, 2026, examines a question that the Trump administration's August 2026 presidential memorandum on transnational cyber-enabled crime leaves open. When vetted private companies run cyber operations against foreign criminal groups under U.S. government direction, who is responsible under international law for what those companies do abroad? The first three installments cover the United States, Germany and France. The U.S. and French pieces argue that the United States does not shed responsibility by outsourcing the work; the German piece examines the domestic constitutional limits on Germany's own, state-run powers. The French piece also sets out how France's view of private involvement and of the reach of self-defense differs from Washington's.

The U.S. program and its limits

Lisandra Novo, a senior law and tech advisor with the Atlantic Council's Strategic Litigation Project, opens the series by describing the memorandum, titled "Expanding Capabilities to Combat Transnational Cyber-Enabled Crime." According to her account, it directs the National Coordination Center to set up a program under which vetted private companies conduct cyber surveillance and cyber effects operations against foreign transnational criminal organizations, under federal control and oversight. Participating firms must post a bond of at least one million dollars. Novo places the memorandum alongside a March 2026 executive order and a March 2026 cyber strategy. She also notes a proposed Senate amendment to the 2027 National Defense Authorization Act that would create a pilot program for contractor-conducted access operations, and a House bill, the Scam Farms Marque and Reprisal Authorization Act of 2025, that would revive letters of marque and reprisal.

The memorandum bars private participation in operations that could produce "Critical Outcomes," a category that, as both Novo and a later contributor describe it, covers operations that could cause loss of life or serious injury, or that could rise to the level of a use of force or an armed attack under international law. Novo argues that this carve-out leaves hard questions in place. It asks private firms to judge where the threshold lies, and she finds it difficult to imagine that participating companies would have the necessary legal infrastructure to do so. She also observes that the U.S. treats the use-of-force threshold case by case, while the Netherlands and Belgium have said in national positions that non-physical operations causing serious economic or financial harm might qualify, and Denmark's position treats cyber acts of political coercion as potentially amounting to a use of force. Several states, she adds, accept that a series of related sub-threshold incidents can together amount to an armed attack, which she identifies as a serious risk for a program built from many smaller operations.

Attribution runs back to Washington

On state responsibility, Novo turns to the International Law Commission's Articles on State Responsibility. She argues that the private companies' conduct would be attributable to the United States under Article 5, which covers entities empowered by law to carry out functions of a public character normally exercised by state organs, and under Article 8, which covers conduct carried out under a state's instructions, direction or control. In her view, the vetting process, operational rules and written approval requirements show enough U.S. control to satisfy that test. She also flags the memorandum's presumption that targeted groups are not linked to a foreign government "unless clear intelligence exists establishing such connection," and warns that this could sweep in groups in a gray zone between criminal and state activity. Because those groups operate from other states' territory and rely on civilian infrastructure, she argues, effects could reach the states where those groups are located, including their critical infrastructure. She describes sovereignty and non-intervention as relevant and says a fuller analysis of them is beyond the scope of her piece.

Germany: "active cyber defense" at home

Simone Ruf of the German civil-rights group Gesellschaft für Freiheitsrechte writes, in a November 5 installment, that Germany's government describes the powers in its pending security bills as "active cyber defense" and rejects the term "hack-back." Unlike the United States, Germany does not plan to outsource these operations to private companies, and her analysis is mainly constitutional. The bills would allow police agencies to intrude into threatening systems and read, delete or alter data, and in exceptional cases operations could be triggered automatically by software. She warns that wrong attribution or misjudged effects could have consequences under international law and that automated operations could lead to escalation between states. She leaves open whether such operations should require parliamentary approval in the way foreign armed deployments do.

France: a narrower view of self-defense

In the November 6 installment, Lori Roussey, founder of the non-profit Data Rights, contrasts the U.S. approach with French doctrine. She writes that France's 2018 cyber defense position holds that hack-backs by private actors should be prohibited under international law, and that French private firms support analysis, forensics and crisis management but do not conduct cyber operations. On self-defense, she reports that France accepts anticipatory action against imminent attacks and the accumulation-of-events theory but rejects preventive self-defense. She describes the U.S. position as broader, because it contemplates operations in the cyberspace of a state deemed "unwilling or unable" to act against criminal activity. She warns that private operators acting across several countries could raise tensions between states.

What to watch

The series is commentary, and its conclusions on attribution and thresholds are the authors' arguments, not settled findings. Still, it maps the issues that any effort to codify the memorandum in statute, or the NDAA pilot, will face: whether outsourced operations stay below the use-of-force line, how allied states that reject private hack-backs will respond to effects on their networks, and whether the United States accepts that conduct it directs is its own. A Japan entry has been announced but had not appeared as of this writing.

Sources