In August, the Trump administration announced plans to allow vetted private companies to participate in “offensive cyber operations” carried out by the U.S. government. The initiative’s stated primary goal is to reinforce law enforcement’s fight against transnational criminal groups, although it also includes intelligence-gathering and defense features. This change in U.S. policy provides an opportunity to compare the state of other countries’ positions on letting non-state actors conduct active cyber-defense missions.
According to NATO’s website, taking action against a malicious cyber operation to mitigate or block its effects is called a hack-back. From the perspective of France, letting private actors conduct hack-back operations is neither acceptable domestically, nor a practice that should be allowed by the international community, especially as the Trump administration’s interpretation of “self-defense” under international law is significantly broader than France’s.
France’s Approach to Fighting Transnational Criminal Groups
France tackles cybercrime through law enforcement as well as through its intelligence services.
Regarding French law enforcement, the fight against cybercrime sits with the Police as well as the Gendarmerie, the latter employing military personnel. Two units lead cyber-operations: the Office Anti-Criminalité (OFAC) that employs police forces focused on cyberattacks, the dark web, and country-wide coordination on cybercrime response; and the Unité Nationale Cyber (UNC), which is staffed with gendarmes to focus on organized crime such as ransomware attacks. The Ministry of Interior provides oversight of both units.
With regard to the new U.S. effort announced in August, the closest policy equivalent for France would be its 2025-2028 national strategy to combat cybercrime. Although the country formally cites public-private partnerships as a pillar of its approach, there is no evidence that France has a program geared toward allowing the private sector to take part in operations against criminal threats. Private partners are involved in threat analysis, forensics, prevention, and crisis management. In simple terms, they support crime prevention and fighting, but companies are not authorized to carry out cyber operations against criminal actors by themselves. Active cyber defense (e.g. penetration of systems, neutralization, disruption) remains entirely in the hands of authorities.
In parallel to law enforcement, as part of their legal mandate, intelligence services will gather intelligence useful to prevent organized crime and terrorism. France’s intelligence legal framework also does not include any scheme aimed at empowering vetted private actors to conduct intelligence operations.
Circling back to the White House’s policy announcement, President Donald Trump praised the U.S. private sector for providing the country a “critical offensive cyber advantage.” From a French perspective, law enforcement and the intelligence services have operational powers that include powerful tools, but again, their deployment is controlled by the public sector. For instance, hacking techniques that enable the capture of computer data stored, typed, received or as seen on a screen, are available to French law enforcement via the legal basis of the infamous EncroChat case, as well as to the intelligence services, in application of the Criminal Procedure Code and the Interior Security Code. It is noteworthy that although private companies do not have access to such techniques, the list of law enforcement units able to use this type of hacking is long and has been modified approximately every 1.5 years since its adoption in 2015. The relevant article of law on hacking techniques specifies that tools enabling the collection of computer data are only allowed when such data cannot be collected through any other legally authorized way. In addition, intelligence services deploying hacking techniques must report on each deployment to France’s intelligence independent oversight body, the Commission Nationale de Contrôle des Techniques de Renseignements (CNCTR). Whether private actors may lead on cyber operations or not, independence of oversight bodies is fundamental when using such technologies. Such a safeguard is no longer as robust in the United States after the Supreme Court’s ruling in Trump v. Slaughter in June, which found that the president can remove the leaders of independent agencies and commissions. This concern was raised to the European Commission by civil society organisations.
In the past, several United Nations authorities have raised concerns relevant to the impact this new U.S. policy will have on evidence produced by law enforcement. First, in the wake of the Edward Snowden revelations, the U.N. Rapporteur on Freedom of Expression stressed that
[o]ffensive intrusion software such as Trojans […] not only enable a State to access devices, but also enable them to alter – inadvertently or purposefully – the information contained therein. This threatens not only the right to privacy but also procedural fairness rights with respect to the use of such evidence in legal proceedings.
Secondly, in 2017, the U.N. Human Rights Committee urged that
such activities [like offensive intrusion software be associated with] robust independent oversight systems over surveillance, interception and hacking, including by providing for judicial involvement in the authorization of such measures in all cases and affording persons affected with effective remedies in cases of abuse, including, where possible, an ex post notification that they were subject to measures of surveillance or hacking.
International Law Thresholds
The White House’s memorandum limits the operations the private sector may be authorized to conduct, prohibiting participation in operations that could have “Critical Outcomes.” These include operations that could result in the loss of lives and/or could qualify as use of force or an armed attack under international law — that is, operations that another state could qualify as an act of aggression allowing it to legally resort to self-defense under Article 51 of the U.N. Charter. This prohibition echoes the Trump administration’s clear acknowledgement that companies would be participating under the government’s “control and oversight,” meaning that any operation is still the responsibility of the United States.
This restriction on operations that could qualify as a use of force or an armed attack deserves to be read through the lens of France’s defense policy. In line with the U.N. Charter, use of force or armed attacks from an entity vested with a state’s power could be interpreted by France as an act of aggression allowing it to use self-defense. Most importantly, since 2017, France has been clear on its interpretation of its right to self-defense. Like the United States, it is two-fold. First, the right to cyber self-defense extends to anticipatory measures where an attack is imminent, noting that France rejects preventive self-defense, i.e. attacks against a state that neither has the capacity to attack nor the intent. Second, France follows the accumulation of events theory, according to which recurrence and volumes of actions may be taken together to meet the aggression threshold. France’s interpretation of what allows a state to use self-defense is therefore broad, especially because it reserves the right to have its own list of criteria to assess whether the seriousness of actions triggers the qualification of an “armed attack.” These nine criteria are listed in France’s foundational cyber defense position of 2018 and include, for instance, accumulation of events, attribution, intention, and impact on the economy or the environment.
Where France would deem the “use of force” or “armed attack” threshold to be met, its Defence Code allows the state to take hack-back measures as defined by NATO. In fact, hack-back measures have been in France’s Defense Code since 2013. Namely, the Defence Code states that if a cyberattack threatens the country’s security, warfare or economic assets, or the survival capacities of the nation, authorities can deploy techniques allowing it to characterize the attack and neutralize it through the information systems from which it emanates. The Defense Code goes on to specify that the military also has access to hacking tools for intelligence gathering, under the oversight of the CNCTR.
With regard to the Trump administration’s plans, the French defense apparatus, just like its law enforcement counterparts, may only rely on the private sector for intelligence and operational support. In fact, since 2018, France has had a strict position on hack-back operations by private actors: they ought to be prohibited by international law. At the time, the French Defense apparatus included in its definition of hack-backs the aim to inflict a punishment. Taking action against a malicious cyber operation to mitigate or block its effects, ie. NATO’s definition of hack-backs, offers no leeway for violent cyber-offensive acts. It nonetheless remains that the French position is not aligned with a scheme where private actors are vetted to conduct operations or hack-backs, as envisaged by the Trump administration. This is all the more true if hack-backs go beyond the NATO definition as the U.S. government’s memorandum does by allowing the possibility for private actors to interfere with the targeted systems, such as by disrupting or destroying them.
In its 2026-2030 cybersecurity strategy, France cemented its posture, indicating that the mobilization of the private sector is one of its objectives. However, its involvement would remain limited to threat intelligence and operational support for detection, characterization and, if necessary, the blocking of attacks.
Implications of the New U.S. Policy
The policy change announced by the Trump administration in August impacts the broader U.S. cyber industry strategy. With taxpayers’ money financing the development of private offensive capacities, the United States is getting one step closer to the Chinese model. For years, China has been sponsoring offensive groups like the Advanced Persistent Threat (APT) group Judgement Panda to be equipped to deploy lasting attacks on critical infrastructure, like the attack against Sophos in South Asia, codenamed Pacific Rim. These attacks may not have been against organized crime per se, but what constitutes organized crime for one country is somewhat political, as international law offers leeway on domestic interpretation.
This is why the prohibition of the international law thresholds of “use of force” and “armed attacks’” like the targeting of critical infrastructure, may be important safeguards. Nevertheless, in her article previously published as part of this series, Lisandra Novo stressed that tackling international crime may lead to operations impacting critical infrastructure of other countries.
Nevertheless, companies with records of human rights violations are getting ready to respond to the White House’s call. For instance, the Israeli spyware company Paragon recently indicated it would pursue contracts under the White House scheme. The fact that companies selling intrusion technology found to be used on investigative journalists and that admit that their processes cannot withstand the test of democratic accountability is a concerning omen.
Last but not least, unlike France’s position, the U.S. cybersecurity posture allows for two concepts considerably broadening the interpretation of what a state may do in the name of self-defense. First, the United States supports preventive operations, i.e. operations against a state even if they do not have the capabilities nor the intent to attack the United States. Second, the United States allows operations in the sovereign cyberspace of a state deemed “unwilling or unable” to act against organized criminal activities. In the past, this second concept has justified the conduct of counterterrorism operations. In practice, these two concepts mean that in the future, private actors vetted by the U.S. government could find themselves operating in multiple countries, for a wide variety of tasks. A country like France could presumably struggle to find some of these actions legitimate, raising tensions, if not leading to conflict.
In any case, the Trump administration’s policy change may incentivize private entities to obtain more powerful active-defense tools, such as potent zero-days, to competitively position themselves in the market — and all the more now that there is a codification initiative. Once a revocable presidential directive converts into durable statutory demand, investment plans may be impacted. Still, the scheme is limited to vetted entities, but the example of Paragon may be illustrative as it boasts to “provide customers with personnel who possess ‘appropriate clearances.’” States worried by this new policy may find that improved, coordinated disclosures of vulnerabilities that could be exploited would lower risks by increasing private actors’ costs to enter the arena.
