US Government Authorizes Private Cybersecurity Firms for Offensive Operations
On August 13, President Trump signed a national security memorandum that establishes a formal program permitting vetted private U.S. cybersecurity firms to engage in offensive cyber operations against transnational criminal organizations. This initiative is managed by the National Coordination Center and encompasses both intelligence collection, termed Cyber Surveillance Operations, and the disruption of criminal infrastructure, referred to as Cyber Effects Operations. This program represents the formal execution of the White House's Cyber Strategy for America, which aims to leverage the private sector as a key player in offensive cyber activities.
The memorandum emphasizes that the American private sector possesses unmatched innovation and technological capabilities, which can provide a significant advantage in offensive cyber operations. Historically, these capabilities have not been fully utilized in efforts to identify and dismantle criminal networks operating in cyberspace. The policy aims to harness all available national resources, including private sector innovations, to combat cybercrime effectively.
The program specifically targets Cyber-Enabled Transnational Criminal Organizations, defined as foreign groups conducting cyber-enabled crimes against U.S. interests. Notably, the program excludes entities that are part of foreign governments or operate under their direction, focusing solely on criminal networks rather than nation-state adversaries. This distinction is crucial, as the line between criminal organizations and state actors can often be blurred.
The memorandum outlines that Cyber Effects Operations involve activities conducted through interconnected information technology infrastructures, which may result in the manipulation or disruption of information systems and networks. Each operation must receive written approval from executive directors of the Department of Justice and the Department of Homeland Security before proceeding. Operations that could lead to significant outcomes require additional authorization, recognizing that some cyber actions may intersect with laws governing armed conflict.
To participate in this program, companies must undergo rigorous vetting, demonstrate their technical capabilities, and maintain a bond or escrow of at least $1 million, which would be forfeited in case of contract violations. The operational procedures are expected to be finalized within 60 days, and any operation that could affect a U.S. person or raise constitutional concerns will be reviewed by the Justice Department. A key legal question surrounding this initiative is whether the Computer Fraud and Abuse Act (CFAA) exemption for government-authorized investigative activities applies to private companies acting under government contracts. Legal experts suggest that while the exemption likely applies when companies operate under direct government oversight, it may not cover independent operations.
The memorandum makes it clear that government control is paramount at every stage of the operation, requiring written approval for all actions and immediate notification if any unintended contact with U.S. persons or systems occurs. The Justice Department will remain involved throughout the process, ensuring compliance with legal standards and oversight.
