White House Authorizes Private Sector to Conduct Offensive Cyber Operations Against Foreign Criminal Groups

On Aug. 12, President Trump signed a National Security Presidential Memorandum titled “Expanding Capabilities to Combat Transnational Cyber-Enabled Crime” that establishes a federal program authorizing vetted private sector firms to conduct offensive cyber operations against foreign cybercriminal organizations under government direction.

The memorandum expands on Executive Order 14390 of March 6 (“Combating Cybercrime, Fraud, and Predatory Schemes Against American Citizens”) by integrating private sector capabilities. 

Key Provisions of the White House Cyber Operations Memorandum 

The memorandum creates a program, managed by the Departments of Justice (DOJ) and Homeland Security (DHS), that authorizes participating companies to conduct two categories of operations against foreign “Cyber-Enabled Transnational Criminal Organizations” (CE-TCOs):  

• Cyber Surveillance Operations: Covert intelligence-gathering activities on “foreign systems, including accessing systems without the owner's authorization, for the purpose of collecting information that may support future operations.”  
• Cyber Effects Operations: Activities resulting in the “manipulation, disruption, denial, degradation, or destruction of criminal networks' information systems, networks, or infrastructure.” 

Notably, under the memorandum, the definition of a CE-TCO includes a foreign group that “conducts cyber-enabled crime” against the U.S. government, a U.S. person, or “U.S. interests,” and “that is not an institutional part of a foreign government or wholly operated under a foreign government’s direction.”   

While that definition can be thorny, the memorandum states that a foreign group will be assumed not to be an institutional part of a foreign government or wholly operated under a foreign government’s direction “unless clear intelligence exists establishing such connection.” 

Participating companies must undergo vetting, enter into contracts with DOJ or DHS, obtain approvals for cyber operations, and maintain a bond or escrow of at least $1 million, which is subject to forfeiture for failure to comply with contractual agreements.  

The program cannot approve operations likely to result in loss of life, serious injury, or “activity rising to the level of use of force or armed attack under international law.” In addition, the program must ensure that any activity directed at a U.S. person receives “necessary authorization, judicial or otherwise, prior to approval.”  

The memorandum calls for DOJ and DHS to establish operational procedures and detailed eligibility standards for participating companies within 60 days. For now, the memorandum states that those standards must include technical proficiency, proven performance of cyber operations, facility security, personnel vetting, competence, and reliability. 

Legal and Compliance Considerations for Participating Companies 

• Computer Fraud and Abuse Act: The memorandum does not create any general right for a business to “hack back” against cyberattackers. Indeed, unauthorized hacking outside the program remains a federal crime under the Computer Fraud and Abuse Act (18 U.S.C. § 1030). 
• Threat intelligence sharing: The program permits participating companies to contract with private sector firms and federal, state, and local governmental entities to collect threat information. Further, companies victimized by ransomware or cyberfraud should still consider reporting to law enforcement while also evaluating whether to share threat information with authorized operators. 
• Collateral damage and civil liability: Criminal networks frequently use innocent third parties' infrastructure as operational cover. If a participating company damages systems belonging to uninvolved parties in an authorized operation, the memorandum does not state whether civil or criminal consequences could apply. Immunity from such penalties will likely require congressional legislation. 
• Consider your insurance program: The program injects new variables into the cyber risk landscape. A best practice is to consult with your broker or insurance coverage counsel about whether your insurance policy terms might be interpreted as anticipating or otherwise addressing losses from government-authorized offensive activity by third parties. 
• International exposure: Even if an operation is authorized under the program, a participating company’s actions could be deemed to have run afoul of international laws. Hostile states — like Russia, China, Iran, and North Korea — may also target participating companies (and their employees) with prosecution, sanctions, or retaliation. CE-TCOs may also retaliate, leading to escalating attacks. 
• Attribution challenges: Misattribution of a foreign government as a CE-TCO could pose serious consequences for a participating company. And, in this age of “vibe hacking,” proper attribution is increasingly difficult. For example, as reported in The Wall Street Journal, researchers recently used Anthropic’s Claude to write code that altered data produced from computerized scans of physical DNA evidence without leaving behind any trace that they tampered with the records.  

Should Your Company Participate in the Federal Cyber Operations Program? 

In deciding whether to participate, companies should wait for and then study the operating procedures and detailed eligibility criteria for the program, which are due to be released in mid-October. In particular, the current outline of the program contains several ambiguous provisions that will require further clarification. Interested companies should also consult their cyber insurance brokers or insurance coverage counsel about any potential policy effects from participation.