Licensed to Hack Back: Counseling Companies Under the New Private Offensive Cyber Operations Program

Erez Liebermann, Partner, Co-Chair of the Technology Group and Member of the Data Strategy & Security Group | Debevoise & Plimpton LLP

Erez Liebermann is a Partner in the New York office of Debevoise & Plimpton LLP, where he serves as Co-Chair of the firm’s Technology Group and is a member of its Data Strategy & Security Group. He advises major businesses on their most complex and high-impact cyber incident responses and on data-related regulatory and litigation matters, including the investigation and litigation of data breaches, business email compromise, and law enforcement access to data. He counsels C-suite executives and boards of directors on high-profile cyber incident investigations and on reducing data-related regulatory and reputational risk. Mr. Liebermann brings a rare combination of perspectives to that work: he has been a litigator, a federal cybercrime prosecutor, and the senior in-house cybersecurity lawyer at a global financial services company, and he is a trained aerospace engineer. Having spent a decade investigating and prosecuting hackers for the Department of Justice and then building and running a corporate threat intelligence and threat hunting team, he understands both sides of an offensive cyber operation — how the government authorizes, supervises, and prosecutes intrusions, and how a company must govern, document, and defend the actions it takes against an adversary.

• Education & Credentials

Mr. Liebermann earned his J.D. from Columbia Law School in 1999 and his B.S. in Aerospace Engineering from the University of Virginia in 1996. Following law school, he served as a law clerk to Chief Justice Deborah T. Poritz of the New Jersey Supreme Court and to U.S. District Judge Faith S. Hochberg of the U.S. District Court for the District of New Jersey in Newark. His technical training as an engineer underpins a practice that routinely requires translating forensic and operational detail into legal and regulatory judgments.

• Recognition & Leadership

Mr. Liebermann is ranked by Chambers Global (2026), Chambers USA (2025), Chambers FinTech Legal (Data Protection & Cybersecurity), and The Legal 500 US (2025) for cybersecurity and data protection, where clients describe him as “truly a leader in the field of cyber and privacy law” and praise his ability to “blend the legal view with business and operations.” He was named to Cybersecurity Docket’s “Incident Response Elite” list for 2026 and its “Incident Response 50” list for 2025. As a federal prosecutor, he received the Attorney General’s Distinguished Service Award for United States v. Drinkman, the largest credit and debit card hacking prosecution charged to date. He is a frequent media commentator who has appeared on NBC and ABC, and his cases have been featured in numerous television programs and in The Wall Street Journal’s podcast “Hack Me If You Can.” He co-authored two chapters of the second edition of PLI’s Cybersecurity: A Practical Guide to the Law of Cyber Risk.

• Professional Involvement

Mr. Liebermann is regularly relied upon by the financial services industry for input on proposed cybersecurity and technology regulation, including the preparation of comment letters on behalf of SIFMA and GFMA on cybersecurity, operational resilience, and AI regulation. In 2023, he was appointed by the Chief Justice of the New Jersey Supreme Court to the Court’s Committee on Artificial Intelligence. He serves as Co-Chair of the Data and Technology Section of the Association of Life Insurance Counsel, and he previously served on the New York State Cybersecurity Advisory Board, the U.S. Department of the Treasury’s Cybersecurity Public Affairs Committee, and the Cybersecurity and Policy Committees of the Financial Services Sector Coordinating Council. He is an Adjunct Professor at the University of Texas School of Law, where he teaches Cyber Incident Response, and a Fellow of NYU Tandon’s cybersecurity program.

• Experience

Before joining Debevoise in 2022, Mr. Liebermann co-chaired the U.S. cybersecurity and privacy practice of another international law firm. Earlier, as Chief Counsel of Cybersecurity & Privacy at Prudential Financial, he led the company’s legal, regulatory, and investigative matters involving cyber, privacy, data science, and artificial intelligence, advised senior management and the board, and built and managed Prudential’s global technical incident response, threat intelligence, and threat hunting team. He previously spent ten years at the U.S. Attorney’s Office for the District of New Jersey, where he rose to Deputy Chief of the Criminal Division, served as Chief of the Computer Hacking and Intellectual Property Section, and was designated a National Security Cyber Specialist. There he investigated and prosecuted cyber and white collar crimes, including the hackers behind the breaches of Heartland Payment Systems, 7-Eleven, JC Penney, Hannaford Brothers, Visa, and JetBlue, a stock pump-and-dump scheme run through a global botnet, and insider threat and national security cases. That first-hand experience with how the government conducts, authorizes, and polices cyber operations — paired with years of counseling companies on the legal limits of their own defensive measures — makes him uniquely positioned to guide counsel through the risks and obligations of the new private offensive cyber operations program.

Trisha Anderson, Partner | Hecker Fink LLP

Trisha Anderson is a Partner in the Washington, D.C. office of Hecker Fink LLP, where she advises clients in both the private and public sectors on complex constitutional and statutory issues, represents them in trial and appellate litigation, guides them through crises, and responds to inquiries from federal executive branch agencies, state attorneys general, and Congress. Her clients have included major companies, individuals, public officials, universities, nonprofits, and philanthropies, and she regularly counsels them on compliance and risk management in a rapidly evolving and uncertain legal landscape. Ms. Anderson joined the firm after more than a decade in senior roles across the Executive Branch — at the Department of Justice, the Federal Bureau of Investigation, the Department of the Treasury, and the Department of Commerce — where she oversaw the legal support for the FBI’s national security and cyber investigations, supervised Treasury’s sanctions authorities, and advised the White House Counsel and agency General Counsels on the outer limits of presidential and executive power. Few lawyers in private practice have been as close to the government’s own decisions about how, when, and under what authority to act against foreign cyber actors — the very questions companies now face as they consider participating in, or being affected by, the new private offensive cyber operations program.

• Education & Credentials

Ms. Anderson earned her J.D., magna cum laude, from Harvard Law School in 2003 and her B.A., cum laude, from Yale University in 1998. She clerked for Justice Elena Kagan of the Supreme Court of the United States and for Judge Jeffrey S. Sutton of the U.S. Court of Appeals for the Sixth Circuit. She is admitted to practice in the District of Columbia and California.

• Recognition & Leadership

Ms. Anderson is recognized by Lawdragon among the 500 Leading Global Cyber Lawyers (2025–2026), the 500 Global Leaders in Crisis Management (2025–2026), the 500 Leading Litigators in America (2026–2027), the 500 Leading Lawyers in America (2026), the 500 Leading Global Investigations Lawyers (2026), the 500 Leading Global Litigators (2026), and the 500 Leading Civil Rights & Plaintiff Employment Lawyers (2026). She is a frequent faculty member and speaker on national security, cybersecurity, and government access to data, including for the Practising Law Institute, Legalweek, and Stanford Law School’s conference on best practices in cybersecurity and data protection.

• Professional Involvement

Ms. Anderson’s government service spans the agencies that will define how the private offensive cyber operations program is run. At the Department of Justice she served as Principal Deputy Assistant Attorney General in the Office of Legal Counsel, as Associate Deputy Attorney General in the Office of the Deputy Attorney General, and earlier as an Attorney Adviser in the Office of Legal Counsel. At the Department of Commerce she served as Deputy Assistant Secretary for Intelligence & Security, leading the implementation of Commerce’s information and communications technology authorities. At the FBI she served as Principal Deputy General Counsel and Acting General Counsel, and at the Department of the Treasury she served as Assistant General Counsel for Enforcement & Intelligence, supervising all legal advice relating to Treasury’s sanctions authorities, including the Office of Foreign Assets Control (OFAC) and the Financial Crimes Enforcement Network (FinCEN). Her areas of specialty at Hecker Fink include cybersecurity and data privacy, national security and international law enforcement, investigations and crisis management, congressional investigations, and white collar criminal defense.

• Experience

As Principal Deputy Assistant Attorney General in the Office of Legal Counsel, Ms. Anderson advised clients at the highest levels of government — the White House Counsel, agency General Counsels, and DOJ leadership — on some of the most complex and high-stakes legal issues faced by the Executive Branch, including presidential authorities, congressional oversight and executive privilege, and the legal approval of Executive Orders. As Principal Deputy General Counsel of the FBI, she oversaw the legal support to the Bureau’s national security and cyber investigations, handling sensitive national security matters and cyber intrusions. Between her periods of government service, she was a partner at Covington & Burling LLP, where she advised clients on national security, cybersecurity, data security, trade controls, and CFIUS matters, represented clients in enforcement matters before OFAC, Commerce, the Federal Trade Commission, and DOJ, helped technology companies respond to U.S. government data requests, and litigated high-stakes challenges to government action. Having sat on both sides of the table — authorizing and supervising government cyber and sanctions authorities, and then counseling companies on how to comply with and challenge them — she is uniquely positioned to explain what DOJ and DHS oversight of licensed private cyber operations will look like in practice, and how counsel should advise clients on the authorities, limits, and liabilities involved.

Chloe Goodwin, Senior Associate | Hecker Fink LLP

Chloe Goodwin is a Senior Associate in the Washington, D.C. office of Hecker Fink LLP, where she represents companies across a broad range of litigation and compliance matters. She advises clients on regulatory enforcement, the evolving landscape of technology law, and complex privacy issues, including cross-border data transfers, conflicts of law, and law enforcement access to digital evidence. Her practice also focuses on national security concerns, surveillance authority regulations, and key constitutional protections — including the Fourth and First Amendments — as well as Section 230 of the Communications Decency Act. Ms. Goodwin has spent her career at the seam between technology companies and the government: defending companies against legal process for user data, challenging sanctions designations, and analyzing the legal frameworks that govern when private actors may cooperate with, resist, or act on behalf of the state — the central tension of the new private offensive cyber operations program.

• Education & Credentials

Ms. Goodwin earned her J.D., magna cum laude, from Harvard Law School in 2018, where she served as Developments Chair and Notes Editor of the Harvard Law Review and interned in the Office of Law & Policy of the National Security Division of the U.S. Department of Justice. She earned her A.B., magna cum laude, from Harvard University in 2012, where she was elected to Phi Beta Kappa. Following law school, she clerked for the Honorable Paul G. Gardephe of the U.S. District Court for the Southern District of New York. She is admitted to practice in the District of Columbia and New York.

• Recognition & Leadership

While at Harvard Law School, Ms. Goodwin authored the Harvard Law Review Note “Cooperation or Resistance? The Role of Tech Companies in Government Surveillance,” which challenged the conventional framing of technology companies as either compliant “doormats” or protective “bulwarks” against government surveillance and called for regulation that aligns companies’ incentives with those of their users — a framework that speaks directly to the questions raised when the government invites private companies to conduct offensive cyber operations on its behalf. She presented that work through Harvard’s Cyberlaw Clinic at the Berkman Klein Center for Internet & Society.

• Professional Involvement

Ms. Goodwin’s practice sits at the intersection of technology, privacy, and national security law. She counsels clients on the Stored Communications Act and other statutes governing government access to data, on surveillance authorities, on cross-border data transfer and conflict-of-law questions, and on the constitutional limits that apply when the government and private companies act together. Her experience with sanctions litigation under the Administrative Procedure Act gives her direct familiarity with the Executive Branch authorities and judicial review mechanisms that will shape how designated foreign cyber actors are targeted under the new program.

• Experience

Before joining Hecker Fink, Ms. Goodwin practiced at Covington & Burling LLP, where she successfully represented a foreign company in Administrative Procedure Act litigation challenging a sanctions designation, and successfully defended major technology companies against civil and criminal legal process seeking data protected under the Stored Communications Act and the Fourth Amendment, guiding those matters from state and federal trial courts through the appellate courts. That body of work — litigating the boundaries of what the government may compel from, and what it may authorize for, private technology companies — positions her to help counsel evaluate the contractual, statutory, and constitutional exposure that comes with participation in government-sanctioned private cyber operations, including Computer Fraud and Abuse Act risk, foreign-law exposure, and the obligations owed to the users and third parties whose data may be swept up along the way.

Stephanie D. Thomas, Associate, Litigation Department, Data Strategy & Security Group and White Collar & Regulatory Defense Group | Debevoise & Plimpton LLP

Stephanie D. Thomas is an Associate in the Litigation Department of Debevoise & Plimpton LLP in New York and a member of the firm’s Data Strategy & Security Group and White Collar & Regulatory Defense Group. Her practice centers on cybersecurity incident response — including ransomware attacks, large-scale data theft, and cross-border incidents — together with the regulatory notifications, inquiries, and defense that follow. She also advises clients on cybersecurity preparedness, data privacy and strategy, internal investigations, and artificial intelligence governance. Her recent work includes managing incident responses for financial services, insurance, technology, and law firm clients, building AI governance programs, and advising on critical infrastructure and operational resilience regulation, placing her at the center of the regulatory and operational questions companies now face when deciding whether, and how, to engage with government-sanctioned offensive cyber operations.

• Education & Credentials

Ms. Thomas earned her J.D. from New York University School of Law in 2019, where she was a member of the Journal of Legislation and Public Policy, and her B.A., summa cum laude, from Bucknell University in 2013. She is admitted to practice in New York and before the U.S. Supreme Court, the U.S. Courts of Appeals for the First and Ninth Circuits, and the U.S. District Court for the Southern District of New York.

• Recognition & Leadership

Ms. Thomas is a frequent contributor to the Debevoise Data Blog, one of the most widely followed sources of practical analysis on cybersecurity, privacy, and AI regulation, and her writing has been published by the Harvard Law School Forum on Corporate Governance, the Columbia Law School Blue Sky Blog, the NYU Program on Corporate Compliance and Enforcement, and the Journal of Privacy and Data Protection. Her amicus work on behalf of Microsoft in the New Jersey Supreme Court — challenging law enforcement’s use of search warrants rather than wiretap orders to obtain nearly contemporaneous communications — was cited in the Court’s favorable 2023 privacy rights ruling.

• Professional Involvement

Ms. Thomas works closely with trade associations on the policy issues shaping cyber regulation, having prepared comment letters on behalf of SIFMA and GFMA on cybersecurity, operational resilience, and AI regulation. She maintains an active pro bono practice, including filing amicus briefs on behalf of the Lawyers’ Committee for Civil Rights Under Law in the U.S. Supreme Court and the First, Fourth, and Ninth Circuits, and supervising the court administration of a back pay settlement for a class of minority sheet metal workers. She joined Debevoise in 2019 and spent 2022 working in the firm’s London office, gaining direct experience with the multi-jurisdictional dimensions of cyber incidents.

• Experience

Ms. Thomas has led and managed the response to some of the most significant cyber incidents of recent years, including a cybersecurity incident at a leading financial institution involving the data of more than 100 million individuals; an incident at a global entertainment company that required regulator notifications across Europe, Asia Pacific, and the Americas, regulatory defense, and related criminal proceedings; an incident at a CAC 40 company and its global regulatory response; and ransomware attacks and large-scale data thefts at numerous other companies. She has advised Edward Jones Trust Company on cybersecurity matters ranging from advisory work to incident response, and conducted an internal investigation for a multinational consumer goods company into money laundering allegations raised by authorities in the Middle East. Her day-to-day command of how incidents unfold, how regulators across jurisdictions respond, and how law enforcement access to data is litigated gives her a practical vantage point on the compliance, notification, and liability questions that will confront companies, vendors, and their counsel under the new private offensive cyber operations program.

SESSION 1 – The New Private Offensive Cyber Operations Program: Structure, Eligibility, and Oversight | Erez Liebermann & Stephanie D. Thomas | 2:30pm – 3:30pm

This session examines the August 12, 2026 National Security Presidential Memorandum that established the federal framework authorizing vetted private companies to conduct offensive cyber operations against foreign Cyber-Enabled Transnational Criminal Organizations. Attorneys will learn how the program is structured, which companies are eligible and how they are vetted, what categories of operations are authorized, and what oversight and legal guardrails govern participation. Attendees will leave able to identify the program’s legal foundation, its constitutional and statutory ambiguities, and the compliance risks that counsel must understand before advising any client considering participation.

BREAK | 3:30pm – 3:40pm

SESSION 2 – Inside the Operation: Surveillance Law, Government Coordination, and Investigation Risk | Trisha Anderson & Chloe Goodwin | 3:40pm – 4:40pm

This session moves from the program’s rules to the operation itself. Attorneys will examine how participating companies collect, handle, and share data during authorized operations, how they coordinate and deconflict with the FBI and DOJ, and how to prepare for the inquiries, subpoenas, and litigation that can follow when an operation draws scrutiny. Attendees will leave able to spot surveillance-law issues in offensive operations, build evidence-handling protocols that hold up in court, and guide clients through government investigations, third-party claims, and national security review of corporate transactions.