US Government Authorizes Private Companies to Conduct Offensive Cyber Operations

On August 12, President Trump signed a National Security Presidential Memorandum that permits vetted private companies to conduct offensive cyber operations against foreign threat actors, under the oversight of the US government. The White House emphasized the innovative and technologically advanced nature of the American private sector, stating that its capabilities have not been fully utilized in combating cybercrime. The memorandum specifically targets transnational criminal organizations involved in ransomware, phishing, and sextortion campaigns against Americans from abroad. This policy builds upon an earlier executive order signed by Trump in March 2026, which addressed cybercrime and fraud affecting American citizens. Reports indicate that American consumers lost over $20.8 billion to cyber-enabled crime in 2025. The program will be managed by the Homeland Security Task Force’s National Coordination Center, which will be led by two Executive Directors appointed by the Attorney General and the Secretary of Homeland Security. Participating companies are encouraged to collaborate with other private entities and various government agencies to gather intelligence on criminal networks and propose operations against them. The memorandum outlines two types of operations: Cyber Surveillance Operations, which involve unauthorized access to target systems for intelligence gathering, and Cyber Effects Operations, which aim to disrupt or manipulate information systems. Both types of operations require written approval from the Executive Directors, who must coordinate their decisions. Operations that could result in critical outcomes, such as loss of life or serious injury, are prohibited. Companies must also maintain a bond or escrow of at least $1 million to participate, which will be forfeited if they fail to comply with their contracts. Annual reviews will ensure compliance, and any unintentional targeting of US persons or systems must be reported immediately. The memorandum stipulates that all activities must comply with applicable laws and be subject to available appropriations.