The United States government has announced a new policy allowing private cybersecurity firms to conduct offensive cyber operations against transnational criminal organizations. President Donald Trump signed a memo on Wednesday, August 12, 2026, outlining the strategy, which permits contractors to engage in cyber surveillance and technical disruptions of foreign criminal networks. This initiative builds on the "President Trump's Cyber Strategy for America" document released in March, which emphasized leveraging the private sector to enhance national cybersecurity capabilities.
The new policy defines "Cyber Effects Operations" as activities that manipulate, disrupt, deny, degrade, or destroy information systems, networks, physical or virtual infrastructure controlled by information systems, or data residing on them. While a distinction is made between cyber effects and cyber surveillance, the memo acknowledges that surveillance operations, intended for intelligence gathering, may also involve some system disruption or manipulation to maintain stealth.
The scope of targets for these operations includes "any foreign group that conducts cyber-enabled crime against the United States Government, a United States person, or United States interests." Crucially, the definition explicitly excludes entities directly associated with or operating wholly on behalf of foreign governments, indicating that nation-state actors are not targets under this specific program.
Participating companies will undergo a "rigorous vetting" process and must adhere to "strict operational procedures" that are to be developed within 60 days by program executive directors in collaboration with the Homeland Security Council. These firms must demonstrate their technical capabilities annually and maintain a bond or escrow of at least $1 million, which will be forfeited for contract violations. The Justice Department will also authorize operations, particularly those with domestic legal implications or targeting US residents.
The policy prohibits private firms from executing operations that could lead to "critical outcomes," such as loss of life, serious injury, or actions that could be interpreted as an armed attack under international law. The program aims to include both large, well-resourced organizations and smaller, more agile companies capable of specialized tasks.
Legal experts have previously raised questions about the legality of such private sector involvement under existing US law, specifically the Computer Fraud and Abuse Act (CFAA). Some analysts suggested that legislative amendments might be necessary. However, other legal interpretations propose that a provision in the CFAA, Title 18 of the US Code, § 1030(f), could offer protection. This provision exempts lawfully authorized investigative, protective, or intelligence activities by US government agencies.
While no court has yet determined if this exemption extends to private companies acting under government contracts and direction, the government's intention to direct these operations closely may bring them within the scope of the CFAA exemption. This move represents a significant shift in US cybersecurity policy, and its implementation and success are expected to be closely monitored by US allies.
