President Trump signed a National Security Presidential Memorandum on August 12 allowing vetted private companies to run offensive cyber operations against foreign threat actors, under the control and oversight of the US government.
“The American private sector is the most innovative and technologically advanced in the world, and its scale, speed, and capacity secure a critical offensive cyber advantage for the United States,” the White House said.
“Yet, American businesses’ innovative capabilities have historically been underutilized in efforts to identify and disrupt criminal networks operating in cyberspace. Thus, it is the policy of the United States to use all instruments of national power, including the innovative capabilities of the private sector, to combat cybercrime.”
The memorandum targets transnational criminal organizations (TCOs) that run ransomware, phishing, and sextortion campaigns against Americans from abroad. It builds on an earlier executive order Trump signed in March 2026 addressing cybercrime and fraud targeting American citizens.
According to the White House American consumers reported losing more than $20.8 billion to cyber-enabled crime in 2025.
The Homeland Security Task Force’s National Coordination Center will run the program, led by two Executive Directors, one designated by the Attorney General from the Department of Justice and one designated by the Secretary of Homeland Security.
Companies that opt in are encouraged to form agreements with other private entities and with federal, state, local, tribal, and territorial agencies to gather intelligence on criminal networks and propose operations against them.
Operations
The memorandum sets out two kinds of operations. A Cyber Surveillance Operation involves accessing a target’s systems without authorization, with intent to remain undetected, for the purpose of collecting information or intelligence, including information that can be used for future Cyber Effects Operations.
A Cyber Effects Operation results in the manipulation, disruption, denial, degradation, or destruction of information systems, networks, or infrastructure.
Both require written approval and direction from the Program’s Executive Directors before a company can act. The Executive Directors may approve operations after coordinating with each other, but they cannot approve operations resulting in “Critical Outcomes,” defined as an action likely to cause loss of life or serious injury, or to rise to the level of use of force or armed attack under international law.
Requirements and safeguards
Companies must maintain a bond or escrow of at least $1 million as a condition of taking part, forfeited if they fall into non-compliance with their contract. They also face at least annual review to remain in the program.
If a company discovers it has unintentionally targeted a US person, a system residing in the US, or a system under the control of a US person, it must cease the operation, run minimization procedures, and immediately notify the National Coordination Center, which then notifies the Department of Justice.
Any activity directed at a US person requires prior authorization before an operation can be approved.
“This memorandum shall be implemented consistent with applicable law and subject to the availability of appropriations,” the White House noted.
