President Donald Trump has signed a national security presidential memorandum empowering federal law enforcement to use cyber tools against transnational criminal organizations operating in foreign jurisdictions. The measure also creates a controversial framework allowing vetted private companies to conduct offensive cyber operations under direct government oversight. The private sector cyber operations program is intended to target criminal networks involved in ransomware, financial fraud, sextortion schemes, and impersonation scams.
The memo directs the Homeland Security Task Force’s National Coordination Center to establish a program for “cyber surveillance operations” and “cyber effects operations.” These operations could include manipulating, disrupting, denying, degrading, or destroying foreign information systems and networks used by cyber enabled criminal organizations. Participating companies would undergo extensive vetting, operate under oversight from co executive directors at the Department of Justice and Department of Homeland Security, and maintain a bond or escrow account of at least $1 million.
The White House cited the growing financial impact of cybercrime as a major justification for the initiative. American consumers reported losing more than $20.8 billion to cyber enabled crime in 2025, while 73% of U.S. adults reportedly experienced some form of online scam. The administration argues that closer cooperation between government agencies and private cybersecurity firms could help disrupt criminal networks that operate beyond U.S. jurisdiction.
Private sector Cyber Operations Raise Legal and Security Questions
The memorandum represents the clearest step yet toward a policy the Trump administration has been developing since March, when it released its “Cyber Strategy for America.” That strategy called for greater private sector participation in identifying and disrupting adversary networks and envisioned companies playing a larger role in offensive operations against sophisticated military, intelligence, and criminal organizations.
Wednesday’s memo establishes a framework under which private firms can enter agreements with federal, state, local, tribal, and territorial agencies to gather threat intelligence and propose cyber operations. Companies can also establish commercial arrangements with other private entities for sharing information about cyber threats. The program requires compliance with the Constitution and applicable laws, including Section 1030 of Title 18, the Computer Fraud and Abuse Act.
The framework also requires participating companies to immediately stop an operation and notify authorities if they unintentionally target U.S. persons or systems. The administration says these safeguards are intended to prevent unauthorized activity and ensure that offensive operations remain coordinated with federal authorities.
The concept of private sector cyber operations is not entirely new, but it has long generated debate among cybersecurity and national security experts. Earlier proposals, including the 2017 Active Cyber Defense Certainty Act and the 2025 Scam Farms Marque and Reprisal Authorization Act, faced concerns about escalation, unintended consequences, legal liability, and coordination between government agencies and private companies.
The Congressional Research Service has also identified unresolved questions surrounding how targets would be selected and approved, what legal protections companies would receive, and what risks could arise for both participating firms and the United States. The new framework attempts to address some of these concerns through extensive vetting, financial guarantees, and mandatory coordination among federal law enforcement, intelligence agencies, and the Departments of State, Treasury, and War.
Critics nevertheless question whether the government has enough institutional capacity to supervise such a far reaching program. Concerns have grown as the Cybersecurity and Infrastructure Security Agency has faced significant workforce reductions and the administration has reduced some civilian defensive cybersecurity spending while increasing investment in offensive capabilities. The debate over private sector cyber operations is therefore likely to continue as officials determine how to balance the potential benefits of disrupting foreign criminal networks against the risks of giving private companies a more direct role in offensive cyber activity.
