US Companies Authorized to Conduct Cyber Operations Abroad Under New Memorandum

On August 12, Donald Trump signed a memorandum that allows private US companies to conduct cyber operations abroad, focusing on transnational criminal organizations. The White House published the memorandum that night, outlining a program managed by a National Coordination Center and overseen by two Program Executive Directors designated by the Attorney General and the Secretary of Homeland Security.

The memorandum emphasizes the growing threat posed by transnational criminal organizations to American citizens and national security. It states that American businesses have historically underutilized their capabilities in disrupting these criminal networks. According to the accompanying fact sheet, cyber-enabled crime cost American consumers approximately $20.8 billion in 2025, with 73% of US adults having experienced online scams or attacks.

The memorandum defines two types of operations: Cyber Surveillance Operations, which involve unauthorized access to systems with the intent to remain undetected, and Cyber Effects Operations, which aim to manipulate or disrupt information systems and networks. The target of these operations is defined as any foreign group conducting cyber-enabled crime against US interests, excluding groups that are part of a foreign government or operate under its direction.

While the memorandum has been described by some as a license to hack back, it clarifies that companies must operate under federal supervision and contractually approved targets. The longstanding US policy has been that private firms may defend against attacks but not initiate them.

The memorandum requires the Program Executive Directors to establish operating procedures within 60 days, with an initial report due within 180 days. Companies participating in the program must meet minimum standards for technical proficiency and security and must disclose all contractual relationships to the National Coordination Center. They are also required to maintain a bond against non-compliance.

Operations must not lead to critical outcomes that could result in loss of life or serious injury, and any activity directed at a US person requires prior authorization. Companies must also notify the government of imminent attacks on US critical infrastructure.

Industry leaders have welcomed the memorandum, viewing it as a significant shift in the US approach to cyber threats. However, concerns have been raised about the potential risks to individuals involved in these operations and the legal implications of private sector participation in offensive cyber activities. Legal experts have noted that the Computer Fraud and Abuse Act prohibits unauthorized access, and the memorandum does not amend existing statutes, which may lead to legal challenges.