US President Donald Trump has signed a presidential national security memorandum that grants private sector firms the legal authority to execute targeted cyber operations against foreign criminal networks.
This policy pivot allows commercial tech and security firms to step into roles historically reserved exclusively for federal intelligence and defence agencies. By leveraging private innovation, Washington aims to bolster its offensive and defensive posture against increasingly sophisticated digital threats.
The directive does not grant commercial enterprises unchecked freedom to hack foreign entities at will. Instead, it establishes a framework for limited, government-directed cyber operations. A White House fact sheet released alongside the memorandum specifically targets foreign transnational criminal organisations (TCOs) involved in financial fraud, ransomware campaigns, and systemic disruptions of critical infrastructure.
Mounting anxieties over global digital security spurred this move. Earlier this year, malicious actors targeted critical infrastructure across several American states, compromising municipal water supply facilities. At the same time, the emergence of advanced artificial intelligence models capable of breaching legacy defence systems has heightened national security concerns.
Building upon the national cyber security strategy published in March, which advocated for private sector incentives against foreign adversaries, the memorandum establishes a formal framework for public-private cooperation. Private contractors will now be able to enter into agreements with federal, state, local, tribal, and regional government bodies. These partnerships will facilitate threat intelligence sharing and enable private entities to propose tailored offensive cyber operations.
Under the decree, the Department of Homeland Security (DHS) will establish a dedicated initiative within its National Coordinating Centre to disrupt TCO operations. Oversight will be managed jointly by DHS and the Department of Justice.
Authorised firms operating under federal control will be permitted to conduct cyber reconnaissance and active cyber effect operations. These operations include disrupting, degrading, denying access to, or destroying targeted digital networks and physical infrastructure controlled by foreign threat actors.
To prevent misconduct and ensure accountability, participating companies are required to deposit a minimum of $1 million into an escrow bond.
Enlisting private contractors for state-sanctioned digital warfare remains contentious. Legal experts and foreign policy analysts caution that involving commercial entities in international cyber conflicts risks accidental escalation, diplomatic friction, and operational miscoordination among intelligence bodies.
When contacted by journalists for clarification on operational safeguards, both the White House and DHS declined to comment immediately.
