Lawful Targets
Trump has ordered up a corporate cyber militia. Nothing in the order protects the militia.
In the War of 1812, the United States, which possessed a navy of roughly twenty ships, went to war against an empire that possessed six hundred. It closed the gap by outsourcing. A merchant who owned a fast schooner could apply to his government for a letter of marque, a license to capture British merchant vessels on the high seas, sail them into an American port and sell ship and cargo at auction, keeping the proceeds.
It was piracy with paperwork, and the paperwork did two jobs.
The shipowner posted a bond at the customs house, five thousand dollars, or ten if he shipped more than a hundred and fifty men, insuring the government against his misconduct. And the commission he received in exchange converted his crew, if captured, from candidates for the gallows into prisoners of war. The paper told the enemy that these men fought under a flag, and that the flag answered for them.
The arrangement made fortunes in Baltimore and Salem, and in both of the young republic’s wars with Britain the private commissions outnumbered the navy’s own hulls. It also made Captain Kidd. William Kidd sailed from London in 1696 carrying a privateering commission under the Great Seal, financed by four peers of the realm, and when the politics turned, his backers discovered they had never really known him. He was denounced as a pirate and hanged at Execution Dock in 1701, his tarred body hung in a gibbet over the Thames as a caution to sailors.
Kidd’s fatal error was believing that the sovereign’s protection lived on paper rather than in the sovereign’s convenience.
On August 12, the White House revived the business model. A new presidential memorandum titled “Expanding Capabilities to Combat Transnational Cyber-Enabled Crime” directs the creation of a program under which “Participating Companies,” private American firms vetted and contracted by the Departments of Justice and Homeland Security, will conduct “Cyber Surveillance Operations” and “Cyber Effects Operations” against foreign criminal networks, under federal direction. Each company must maintain a bond or escrow of at least one million dollars against misconduct. The customs house has moved to an office park, but a Baltimore shipowner of Madison’s day would recognize the paperwork at a glance.
The memo’s two operational terms deserve translation, because both are considerably gentler than their definitions. “Surveillance,” in ordinary legal usage, means watching: the camera on the pole and the tap on the line. It is a warrant word, passive down to its grammar. The memo’s Cyber Surveillance Operations are defined as entering information systems “without authorization from the owner or operator” with the intent to remain undetected, including whatever “manipulation or temporary disruption” is needed to get in and stay in.
Outside of government, that activity has a shorter name. Federal prosecutors have been sending people to prison for it for forty years. “Effects” is softer still. In military doctrine, cyber effects is the polite term of art for computer network attack, and the memo’s definition reaches past data to the “manipulation, disruption, denial, degradation, or destruction” of physical infrastructure controlled by information systems, which is to say pumps, valves, breakers: the machinery that computers command. In any document not written by the party intending to do it, this is called sabotage.
Our shipowner would notice other differences. The Constitution assigns the power to grant letters of marque and reprisal to Congress, in the same clause as the power to declare war, on the theory that licensing private violence against foreigners is the sort of decision a republic should argue about in public. Reprisal was the older and stranger instrument: a peacetime license for a citizen who had been injured by foreigners and denied justice in their courts, entitling him to seize their countrymen's property until the account was square. No war was required, only the injury. A program that licenses private parties to collect on foreign injuries short of war is this memorandum's business to the letter, and the framers refused even that lesser power to the president.
Privateering itself was formally abolished by the Declaration of Paris in 1856, the treaty the European powers signed at the close of the Crimean War, whose first article reads, in its entirety, “Privateering is, and remains, abolished.” The United States declined to sign, reserving the option, and then never exercised it again. Congress, for its part, has been offered private hack-back legislation repeatedly over the past decade and has repeatedly let it die.
This July it was offered the genuine article. Senator Mike Lee’s (R-UT) Cyber Letters of Marque and Reprisal Act and its identical corresponding House legislation introduced by Congressman Tim Burchett (R-TN) would have the President commission private hackers under the constitutional instrument itself, bond, bounties, and all. It even remembers the shield: holders of the letters could not be sued for what the letters authorize. The bill has the virtue of candor, licensing what its sponsor calls "digital privateers" and petitioning the branch that owns the power. Section 6 automatically extends cyber letter-holders into sea, land, air and space operations if Congress authorizes traditional letters for those domains — the drafters treat cyber commissions as one vote away from kinetic ones.
The memorandum arrived four weeks later without waiting for an answer: a commission with a classified annex, administered through a National Coordination Center that was established by last year’s immigration enforcement order. The White House's position is that no letters are being issued at all: the program is styled as "lawful investigatory, protective, or intelligence operations carried out by Federal law enforcement," its companies cast as ordinary contractors, constitutionally no more interesting than the firm that caters the cafeteria. By that reading, a privateer is a vendor.
In March the administration's cyber officials had assured reporters they had no interest in "fighting pirates with pirates." The paperwork for hiring them followed within five months without statute, debate, or a public list of “designated cyberthreats” as would have been required by the Cyber Letters of Marque and Reprisal Act.
To see what the program asks of its participants, a layperson needs exactly one idea from the law of armed conflict. The whole of that law is laid on a single keel: distinction. Combatants may kill and be killed. Civilians may do neither, and in exchange they may not be targeted. A civilian who takes up arms, or a keyboard employed as one, loses that protection for as long as she directly participates in hostilities, and she gains nothing in return. She may be attacked like a soldier and prosecuted like a criminal. It is the worst seat in the house, and the Tallinn Manual, which passes for the rulebook of cyber conflict, extends it without much strain to people who conduct cyber operations on a state’s behalf. The bargain runs on reciprocity, on each party’s wager that the categories it honors will be honored in return, which means a nation’s conduct doubles as its correspondence: every strike is a memorandum on what the rules now are.
Consider the memoranda the United States has lately been circulating.
Over the past year and a half the administration has gutted the Pentagon offices created to reduce civilian casualties, cutting the military’s Civilian Protection Center of Excellence from forty people to nine. Its forces have destroyed dozens of small boats in the Caribbean and eastern Pacific, killing the accused smugglers aboard without charge or trial; when a monitoring group tried to submit civilian casualty documentation to Southern Command, it was told the command had no mechanism for receiving it. And on the first morning of the Iran war, an American Tomahawk struck the Shajareh Tayyebeh girls’ elementary school in Minab, killing more than 150 people, most of them children. The president attributed the strike to Iran, whose munitions, he explained, have “no accuracy whatsoever.”
Iran does not field Tomahawks.
Adversaries read this correspondence closely, and they will not squint at the civilian category on behalf of an American contractor discovered in their networks. The contractors will be discovered there as instruments of the state. The memorandum repeats, almost anxiously, that every operation will be “exclusively conducted on behalf of and under the supervision of the Federal Government.” Domestically the sentence is exculpatory: it is what keeps a Participating Company’s engineers on the right side of the Computer Fraud and Abuse Act. Internationally it is a return address. Under the customary rules of state responsibility, acts carried out on a government’s instructions are acts of that government, and the people carrying them out are its agents. The clause that spares the operator an American courtroom is the clause that presents him, to a foreign general staff, as an arm of the United States.
The drafters of this memo appear to have surveyed the tripwire themselves, as its exact coordinates can be found within the definitions section: the program’s executive directors “may not approve operations resulting in Critical Outcomes,” meaning those likely to cause death or serious injury, or to “rise to the level of use of force or armed attack under international law.” There is the exact threshold at which nations may lawfully answer with military force, named in a presidential memorandum, and beneath the prohibition a false bottom: the directors may not approve such operations, and about who may, the document says nothing.
The bar itself is a forecast. An operation is blocked only if it is “likely” to kill or to cross the line, a judgment rendered in advance, in Washington, about systems the government does not own in countries it cannot inspect. Minab has established the going rate for such forecasts. The school was ostensibly struck because it sat on a target list built from stale, years-old intelligence, from an era when the building had belonged to the adjacent Revolutionary Guard base. Newer imagery showed a fence and a separate entrance, and photographs taken ten weeks before the strike showed the courtyard filled with people at play. Commanders, according to subsequent reporting, were warned the data was stale and proceeded anyway.
The corporate operators will sit downstream of this machinery, not outside it. Under the memorandum, government agencies name the threats and the companies assemble their target packages on standardized templates. The intelligence beneath those packages comes from the same wells that produced the Minab coordinates.
The Pentagon has meanwhile been replacing the human assessors it cut with artificial intelligence, and the memorandum, in the same spirit, instructs the program to “utilize automation to streamline Program elements wherever appropriate.” The species of error that promoted a girls’ school to a naval facility will ride this program’s paperwork as well. Automation shortens the interval between the mistake and the damage, and the damage will land in shared quarters: a hospital might share a rack with a bulletproof hosting outfit; a water utility runs the same industrial controllers as a crime group’s mining operation. Meanwhile, the memorandum only provides procedures for deconfliction across the departments and the intelligence agencies.
Whom, exactly, will these companies be hacking? The memorandum limits the program to foreign criminal groups that are not part of a foreign government, and it instructs that a group be presumed independent “unless clear intelligence exists” proving a state connection. On first reading the presumption looks like a restraint, but it is closer to a skeleton key.
The most damaging cybercrime enterprises are damaging precisely because governments shelter them. Russian services tolerate the ransomware crews and occasionally task them, and the scam compounds on the Myanmar border answer to militias allied with the junta. North Korea’s fraud apparatus is not adjacent to that state; it is a line item in its budget. The connection is real and concealed on purpose, and anyone who has worked attribution knows how rarely the intelligence is clear. So the presumption does not steer the program away from state-protected targets. It authorizes operations against them by default, resolving on paper an ambiguity no one can resolve in fact. An American company will be cleared to break into a network that Washington has classified as criminal and that Moscow or Pyongyang quietly considers its own, and the company will learn which kind of network it was inside from the nature of the response. Nothing obliges the response to arrive through a lawyer.
Nor is a harder kind of response hypothetical. In 2015 the United States killed the Islamic State’s black hat hacker and propagandist Junaid Hussain with a drone strike, having concluded that a man at a keyboard was a lawful military target. In 2019 Israel answered a Hamas cyber operation with an airstrike on the building where the operators worked, and announced it on social media. The precedent exists, and the opening entry is American: states have already decided that cyber operations can be repaid in ordnance. What this memorandum changes is not the principle but the personnel. Until now, the people on that particular target list wore uniforms or pledged themselves to terrorist organizations. Within months, under contracts now being drafted, some of them will carry corporate badges and stock options.
Here the comparison to 1812 stops flattering the present. The privateer’s commission was a shield as well as a license; it bought his crew prisoner-of-war status, a promise that capture meant confinement rather than a rope. A presidential memorandum can confer no such thing, because combatant’s privilege is not Washington’s to grant by memo. The engineer of a Participating Company who is detained in a third country is a criminal defendant. The one whose operation a foreign government chooses to call an armed attack, or whose employer’s office park a foreign government chooses to call a military objective, has no status at all, only a job title. Kidd’s commission bore the Great Seal of England, and it protected him for exactly as long as his sponsors found him useful. These operators will hold contracts with two cabinet departments and the protection, in the moment it matters, of neither.
A uniform is a letter addressed to the enemy, and it says one thing: this one you may kill, and in exchange you will spare the rest. The memorandum issues no such letters. It offers the mission and the pay, the flag’s direction without the flag’s protection, and it will find takers, because the work is fascinating and because Americans have never fully believed that the wars we conduct at a distance can arrive at the office.
The five-thousand-dollar bond of 1812 insured the government against the privateer’s misconduct. The million-dollar escrow of 2026 does the same.
No one, then or now, thought to insure the crew.
♦