White House Authorizes Private Firms to Conduct Offensive Cyber Operations

President Donald Trump signed a memorandum on Tuesday that directs the federal government to involve vetted U.S. companies in offensive cyber operations targeting foreign criminal networks. The National Security Presidential Memorandum, dated August 12, establishes a program within the National Coordination Center of the Homeland Security Task Force.

The White House stated that this memorandum aims to expand the fight against cybercrime perpetrated by transnational criminal organizations (TCOs) by incorporating the innovative capabilities of the private sector. By partnering with vetted companies under federal oversight, the government seeks to enhance its ability to counter TCO threats and combat various forms of cybercrime, including fraud and other predatory schemes against American citizens.

The program will be overseen by two executive directors from the Department of Justice and the Department of Homeland Security. Private firms that contract with these agencies can propose and execute operations to access, surveil, disrupt, or dismantle systems linked to these networks operating abroad.

To participate, a company must apply, pass a vetting process, and post a bond or escrow of at least $1 million, which will be forfeited if the rules are violated. The company will gather threat information from other businesses or state and local agencies before proposing operations to the National Coordination Center at Homeland Security. No action can be taken until the executive directors review and approve the proposed operations, ensuring that the government retains operational control.

The memorandum authorizes "Cyber Surveillance Operations," which involve accessing systems without the owner's permission or exceeding authorized access, as well as broader offensive actions against networks responsible for ransomware, phishing, financial fraud, and sextortion schemes. Operations that could result in "Critical Outcomes" are prohibited, and any action affecting a U.S. person or system must cease immediately, following established minimization procedures.

According to the memorandum, it is the policy of the United States to utilize all available instruments of national power, including the innovative capabilities of the private sector, to combat cybercrime. The scale of the threat justifies this approach, as crypto scams alone are estimated to have cost Americans around $80.7 billion in 2025. North Korean hackers have developed increasingly sophisticated methods for laundering stolen cryptocurrency, with the government already seizing over $25 million linked to investment and romance scams. This new program aims to expand the model of private sector involvement in addressing these threats.

The specific targeting rules for the program are classified, leaving the public with limited details on the operational guardrails. Companies will have 60 days to prepare before implementation guidance is issued.