The privatisation of America's cyber force

American investors have learned to read any sentence containing "cyber" and "Pentagon" as a summons to buy. So the proposal now before the Senate sounds irresistible: for the first time, Congress would explicitly authorise private contractors to carry out offensive cyber missions, hacking foreign computers under military direction. The natural read is a new revenue line for the handful of firms that already live inside American intelligence — Booz Allen, CACI, Leidos, SAIC, and their software cousin Palantir. Read the provision itself and the picture thins.

The pilot's small print

The authority sits inside the Senate's annual defence-policy bill, the fiscal-2027 National Defense Authorization Act, advanced in June by the Armed Services Committee on an 18-9 vote. It would let contractors, using contractor-owned and contractor-operated means, generate and maintain access to systems the military wants into — only access. The text explicitly withholds what the Pentagon calls "effects": denying, degrading, disrupting, destroying or manipulating systems. Those remain government business. The exercise is a pilot, launched by March 1 2027 and expired by December 31 2030, run under Cyber Command's operational authority, with the Pentagon reporting to Congress and briefing lawmakers quarterly.

Nor is it yet law. The House passed its own NDAA without the provision; the language must survive a conference in which the two chambers reconcile a $1.15trn defence bill. Whatever revenue the pilot would eventually deliver is, on its face, small and slow. A pilot is a test, budgeted as one — a rounding error against the franchises these firms already run.

Why cross the line at all

The question is what the test is for. America faces, by official reckoning, a ten-to-one disadvantage to China in cyber personnel. Its own offensive force is fraying: Cyber Command has struggled with burnout and retention, suffered a reported spike in suicides among its staff, and is being reorganised as "Cybercom 2.0". The administration's cybersecurity strategy and presidential memorandum pushed to "unleash the private sector" and, more boldly, permitted firms to conduct "cyber effects operations" that disrupt or destroy targets. The Senate provision completes the thought by handing the keyboard itself to civilians.

That is the structural shift, and it is why the pilot matters more than its budget. Backers reach for history: the constitution's letters-of-marque clause, the mechanism by which the young republic outsourced war at sea to privateers before abandoning the practice after 1812. If the privateer analogy holds, contractors stop being vendors — people who sell tools, analysis and training to the state — and become operators, arms of the force. The firm that can clear that line first holds a first-mover claim on an operating capability the state can no longer staff for itself.

The price of the keyboard

The step that opens that market is the step that closes the door on the contractors' old identity. Operators are targets. A general counsel worries about compliance; a target worries about survival. Booz Allen, to take the obvious case, runs significant infrastructure; a retaliatory strike on such firms would send ripple effects through their core businesses and through their ability to keep doing the classified work that is their actual revenue. Their networks, employees and tooling become legitimate objects of adversary action, and their counterintelligence exposure rises. It is a new class of risk that no historical share price captures, because it did not exist before.

The honest summation is that this is option value, not current earnings. The beneficiaries, should the pilot prove out, are most plausibly the incumbents already holding the clearances and the bench — and their economics are those of government services: cleared labour, contract margins, consulting, not the scalable software of the headline's dreams. The temptation is to treat a pilot for a future market as a reason to bid today. The better reading is to notice what the provision quietly moves: not money, but the boundary between the state and the firms that serve it, and the risk that moves with it.