Trump Administration Authorizes Private Firms to Conduct Offensive Cyber Operations Against Foreign Criminal Groups

President Donald Trump has signed a National Security Presidential Memorandum establishing a framework that permits screened American private companies to execute cyber operations targeting foreign criminal organizations engaged in cyber-enabled attacks. The federal government will maintain direct oversight and authorization of all such operations, marking a significant shift in how the U.S. government combats transnational cybercrime.

The memorandum authorizes two categories of cyber activity. Participating companies may conduct covert intelligence gathering from computer systems belonging to targeted criminal groups, and with explicit federal approval, they may manipulate, disrupt, deny access to, degrade or destroy digital infrastructure and systems controlled by these organizations. All operations must remain under government direction and require prior written authorization from executive directors at the Department of Justice or Department of Homeland Security.

Cybercriminals operating from foreign locations continue to inflict substantial financial damage on Americans and U.S. institutions. The FBI’s Internet Crime Complaint Center recorded 1,008,597 complaints in 2025, with reported losses totaling $20.877 billion—a 26 percent increase from 2024. The White House attributes these sophisticated campaigns to foreign-based criminal organizations conducting ransomware attacks, phishing schemes, financial fraud and impersonation scams.

Participating companies must meet rigorous vetting requirements examining technical competency, previous cyber operations experience, facility security, personnel screening and overall reliability. The government may require companies to maintain a bond or escrow account of at least $1 million, which could be forfeited if contractual obligations are violated. Both large enterprises and specialized smaller firms are eligible to participate in the program.

The memorandum defines eligible targets as Cyber-Enabled Transnational Criminal Organizations, or CE-TCOs—foreign groups conducting cyber-enabled crimes against the U.S. government, American citizens or U.S. interests. The definition explicitly excludes organizations that function as institutional components of foreign governments or operate under direct government control, establishing important boundaries for these intrusive operations.

Built-in safeguards require participating companies to immediately halt operations that unintentionally target U.S. persons, systems located within the United States or systems controlled by Americans. Companies must notify the National Coordination Center and implement required minimization procedures. Operations that risk loss of life, serious injury or could constitute use of force under international law cannot receive approval from DOJ or DHS officials managing the program.

Program administrators have 60 days from August 12 to establish detailed operating procedures governing company eligibility, targeting protocols, legal review processes, reporting requirements and federal oversight mechanisms. Status reports must be submitted to the White House within 180 days, with annual reports required thereafter. Participating companies face mandatory annual reevaluation for continued participation in the program.

The framework is now operational, though critical implementation details remain under development. For individual Americans, cybersecurity practices continue to represent the first line of defense against criminal actors seeking to compromise personal devices, steal financial information or commit identity theft. The program’s success will ultimately depend on how carefully federal officials supervise participating companies and enforce operational safeguards once activities commence.