Trump authorizes vetted US firms to conduct cyber ops against foreign criminal groups

In mid-August, President Trump signed a national security memorandum that fundamentally shifts how the U.S. government fights foreign cybercriminals. Rather than limiting offensive cyber work to federal agencies alone, the new framework authorizes vetted private American companies to conduct cyber operations against foreign criminal organizations—but only under direct federal supervision and approval.

The scale of the problem the government is trying to address is staggering. Last year, the FBI's Internet Crime Complaint Center logged over one million complaints from Americans, with reported losses totaling nearly $21 billion—a 26 percent jump from the year before. Foreign-based criminal groups orchestrate sophisticated ransomware campaigns, phishing schemes, financial fraud, and impersonation scams that target both individual Americans and U.S. institutions. As artificial intelligence becomes more sophisticated, these attacks grow harder to detect and distinguish from legitimate communications. Stolen personal data circulates through criminal networks for years, meaning victims often find themselves targeted repeatedly.

The memorandum creates two distinct categories of operations that approved private companies could execute. The first, called a Cyber Surveillance Operation, allows companies to secretly access targeted computer systems to gather intelligence—potentially without the system owner's knowledge or permission. The second, a Cyber Effects Operation, permits companies to manipulate, disrupt, deny access to, degrade, or destroy digital infrastructure and systems controlled by criminal organizations. These are not passive defensive measures. They are offensive actions conducted on foreign soil against foreign actors.

But the framework includes substantial guardrails. Participating companies must pass rigorous vetting that examines technical capability, prior cyber operations experience, facility security, and personnel reliability. They must sign contracts with either the Department of Justice or the Department of Homeland Security. Every operation requires written approval and direction from executive directors at those agencies before it can proceed. The government may also require companies to maintain a bond or escrow account of at least $1 million, forfeitable if they violate their agreements. The memorandum does not name any companies that will participate, and the government has deliberately structured the rules to allow both large firms and smaller specialized operators to qualify.

The targets are narrowly defined as Cyber-Enabled Transnational Criminal Organizations—foreign groups conducting cyber crimes against the U.S. government, American citizens, or U.S. interests. Critically, the definition excludes organizations that are part of a foreign government or operate under its direction. This boundary matters because the operations authorized are deeply intrusive. If a company discovers that an operation has accidentally targeted a U.S. person, a system in the United States, or a system controlled by an American, it must immediately halt the operation, follow minimization procedures, and notify the National Coordination Center, which then alerts the Justice Department. Operations that could result in loss of life, serious injury, or constitute an armed attack under international law are explicitly prohibited from approval.

The memorandum establishes the framework, but the actual operating procedures remain under development. Program leaders have 60 days from mid-August to write the detailed rules governing company eligibility, targeting decisions, legal review processes, reporting requirements, and federal oversight mechanisms. Participating companies will face annual re-evaluation. Within 180 days, officials must deliver a status report to the White House, with additional reports required annually thereafter. The structure is in place. The machinery that will make it work is still being built.

For ordinary Americans, the immediate impact is invisible. No one needs to change settings or take action. The real consequence plays out in the shadows—whether approved operations successfully disrupt criminal infrastructure, whether the intelligence gathered helps law enforcement, and whether federal supervision remains tight enough to prevent overreach. The memorandum attempts to give the government a new tool against foreign cybercriminals while building in legal review, operational safeguards, and financial accountability. Whether those safeguards prove sufficient depends entirely on the rules now being written and how strictly federal officials enforce them once operations begin.