President Donald Trump has signed a National Security Presidential Memorandum that creates a framework for vetted private U.S. companies to conduct cyber operations against certain foreign criminal groups, with the federal government providing direction and oversight. The initiative aims to bolster efforts against foreign-based criminal organizations responsible for sophisticated cyberattacks targeting Americans and U.S. interests.
Two Types of Cyber Operations
The memorandum outlines two broad categories of activity for participating companies. Cyber Surveillance Operations will allow companies to secretly collect intelligence from targeted computer systems. Cyber Effects Operations, with federal approval, can involve manipulating, disrupting, denying access to, degrading, or destroying systems and digital infrastructure controlled by targeted criminal organizations.
These operations are intended to target Cyber-Enabled Transnational Criminal Organizations (CE-TCOs). The definition explicitly excludes organizations that are part of or wholly operated under the direction of a foreign government. This distinction is crucial given the potentially intrusive nature of the authorized operations.
Government Oversight and Company Requirements
Companies wishing to participate must be vetted by the government and enter into contractual agreements with either the Department of Justice (DOJ) or the Department of Homeland Security (DHS). All operations must be conducted on behalf of the federal government and under its supervision. DOJ and DHS executive directors will review and approve cyber operation packages before companies can act.
Vetting standards will examine technical proficiency, past cyber operations, facility security, and personnel reliability. The program rules must accommodate both large corporations and smaller, specialized firms. Participating companies may also be required to maintain a bond or escrow account of at least $1 million, which could be forfeited upon violation of their contractual agreement.
Safeguards and Limitations
The memorandum includes safeguards for operations that may inadvertently cross boundaries. If a company discovers an operation has unintentionally targeted a U.S. person, a system located in the U.S., or a system controlled by a U.S. person, it must immediately cease the operation. The company is required to implement minimization procedures and notify the National Coordination Center, which will then inform the Justice Department. Operations involving U.S. persons or other legal concerns must undergo a Justice Department review and receive authorization.
A significant restriction prohibits operations likely to result in loss of life, serious injury, or constitute a use of force or armed attack under international law. Officials running the program are not permitted to approve operations that would produce such "Critical Outcomes."
Developing Operating Procedures
While the memorandum establishes the framework, detailed operating procedures are still under development. Program leaders have 60 days from August 12 to create rules governing company eligibility, targeting, legal review, reporting, and federal oversight. Participating companies will undergo annual evaluations. Within 180 days, program leaders must submit a status report to the White House homeland security adviser and the National Cyber Director, with additional annual reports to follow.
The cybercrime threat remains significant, with the FBI's Internet Crime Complaint Center reporting over 1 million complaints and over $20 billion in losses in 2025. The White House cites increasingly sophisticated campaigns, aided by technologies like artificial intelligence, as a reason for this new approach.
For the public, the program's impact is primarily behind the scenes. Individuals are not required to take any immediate action, as the focus is on federal efforts to disrupt foreign criminal infrastructure and gather intelligence. Personal cybersecurity habits remain essential for individual protection.