[FORECAST] Who Gets to Hack Back for the Government?

Our call is 45% YES by September 8, 2027, with moderate confidence: the U.S. government will publicly name at least one company participating in the CE-TCO Program, or publicly attribute a completed Cyber Effects Operation to it. The program has a real implementation path, but federal control, classified workflow, participation friction, and no public-reporting requirement favor silence.

For defenders and newer CTI analysts, the payoff is not predicting a dramatic “hack back.” It is learning to separate authority, preparation, execution, and public proof—before those categories get flattened into one headline.

Forecast in one line

45% YES by September 8, 2027: public proof will identify a government-confirmed participant or attribute a completed Cyber Effects Operation to the CE-TCO Program, but secrecy still gives NO a slight edge.

The call

• Forecast question: Will the U.S. government publicly identify at least one participating company, or publicly attribute a completed Cyber Effects Operation to the private-sector CE-TCO Program, by September 8, 2027?
• Probability: 45% YES
• Horizon: Through 11:59 p.m. America/New_York on September 8, 2027
• Confidence: Moderate

A YES requires one of two things:

1. A company is named as a CE-TCO Program participant and that participation is confirmed by the U.S. government; or
2. A qualifying public source explicitly attributes a completed Cyber Effects Operation to the program.

Qualifying evidence may come from an official U.S. government statement, a government-confirmed company statement, formal congressional testimony, or a qualifying court filing. A court filing must be adopted or factually affirmed by the government, or contain a competent participant’s sworn, direct-knowledge statement corroborated by an official government statement or filing.

The boundary matters. Surveillance alone does not qualify. Neither does an approved but unfinished effects operation, a general contract award, unnamed private-sector assistance, intelligence sharing, an ordinary civil disruption, an anonymous-source claim, or an uncorroborated private allegation.

Why we think this

The August 12 presidential memorandum does more than gesture toward public-private cooperation. It directs the National Coordination Center to create and maintain the program. Participating companies require contracts and vetting, while operations require procedures, written approval, direction, and federal oversight. Those are concrete steps toward execution.

They are not execution.

That distinction is the analytical center of the forecast. Authority creates an option. Contracts, vetting, appropriations, approvals, and a company’s willingness to accept exposure determine whether the option gets used. Disclosure incentives then determine whether the public ever sees evidence that counts.

The actors are solving different problems:

• The White House and NCC can seek visible disruption of foreign cyber-enabled transnational criminal organizations while trying to control escalation.
• DOJ, DHS, the Department of War, and intelligence agencies have incentives to preserve operational control, deconfliction, and evidence.
• Participating companies may value mission access and federal contracts, but potential bond or escrow requirements, liability, and reputational exposure raise the cost of joining visibly.
• Insurers and shareholders prefer bounded exposure.
• Foreign hosts and targeted criminal organizations can raise the diplomatic, attribution, and retaliation costs of an operation.

The case for YES is straightforward: the administration has publicly presented the program as a way to disrupt ransomware, phishing, fraud, sextortion, and impersonation associated with foreign TCOs. Publicly demonstrating a result could validate that policy. Formal participation also creates artifacts—selection mechanisms, contracts, testimony, filings, and company disclosures—that may become visible even if operational details do not.

The case for NO is stronger by a narrow margin. A classified annex governs workflow and target adjudication. The required status report is directed to Executive Branch officials, not to Congress or the public. Implementation depends on appropriations. The firms most willing and able to participate may also be the least interested in advertising the relationship.

In other words, the government can run a meaningful program that still resolves NO. Public silence is not proof of inactivity.

The paywall tear line

The free story is that private firms have been authorized. The useful analysis begins with what would prove participation or effects—and which incentives keep that proof out of view.

Scenario map

32% — A participating company is named

An official statement, formal testimony, or a mutually confirmed company disclosure identifies at least one firm accepted into the program. This route does not require public detail about a specific operation, making it the more likely YES pathway.