The White House has authorized private U.S. companies to conduct offensive cyber operations against foreign criminal networks, under the direct control and oversight of the U.S. government. President Trump signed a National Security Presidential Memorandum on August 12, allowing vetted private entities to engage in such activities.
This new policy aims to leverage the private sector's technological capabilities to disrupt transnational criminal organizations (TCOs) that operate from abroad, engaging in activities such as ransomware, phishing, and sextortion campaigns targeting Americans. The White House stated that American consumers reported losses exceeding $20.8 billion to cyber-enabled crime in 2025. This memorandum builds upon an earlier executive order signed by President Trump in March 2026, which focused on combating cybercrime and fraud against U.S. citizens.
The program will be managed by the Homeland Security Task Force's National Coordination Center, led by two Executive Directors. One Director will be designated by the Attorney General from the Department of Justice, and the other by the Secretary of Homeland Security. Participating companies are encouraged to collaborate with other private entities and with federal, state, local, tribal, and territorial agencies to gather intelligence and propose operations.
The memorandum outlines two types of authorized operations. A Cyber Surveillance Operation involves unauthorized access to a target's systems with the intent to remain undetected, primarily for intelligence gathering that could inform future operations. A Cyber Effects Operation, conversely, aims to manipulate, disrupt, deny, degrade, or destroy information systems, networks, or infrastructure. Both types of operations require written approval and direction from the program's Executive Directors before a company can proceed.
While the Executive Directors can approve most operations after coordinating, they are prohibited from authorizing actions that could result in "Critical Outcomes." These are defined as actions likely to cause loss of life or serious injury, or those that could be considered a use of force or armed attack under international law.
To participate, companies must maintain a bond or escrow of at least $1 million, which can be forfeited if they fail to comply with their contract. They will also undergo at least an annual review to remain in the program. Strict safeguards are in place for unintended targeting: if a company discovers it has inadvertently targeted a U.S. person, a system located in the U.S., or a system controlled by a U.S. person, it must immediately cease the operation, implement minimization procedures, and notify the National Coordination Center, which will then inform the Department of Justice. Any activity intentionally directed at a U.S. person requires prior authorization before an operation can be approved.
The White House emphasized that the memorandum will be implemented consistent with applicable law and subject to the availability of appropriations.
