Trump Authorizes Private Companies to Conduct Offensive Cyber Operations

President Donald Trump signed a National Security Presidential Memorandum on August 12, 2026, establishing a program that authorizes vetted U.S. private companies to conduct offensive cyber operations against foreign transnational criminal organizations. The initiative targets cyber-enabled crimes, including ransomware, phishing, and sextortion, which the White House stated cost Americans over $20 billion in 2025.

Under the directive, participating firms can perform cyber surveillance to gather intelligence and cyber effects operations to manipulate, disrupt, or destroy foreign information systems and infrastructure. These actions require written approval from the Department of Justice and the Department of Homeland Security, managed through the National Coordination Center within the Homeland Security Task Force. To participate, companies must undergo rigorous vetting and maintain a bond or escrow of at least $1 million, which is forfeited upon contract violations.

The memorandum prohibits operations likely to cause loss of life, serious injury, or actions that constitute an armed attack under international law. It specifically excludes targets that are institutional parts of or directed by foreign governments. The National Coordination Center has 60 days to finalize operating procedures.

Supporters argue the move leverages private sector innovation to scale the government's ability to disrupt adversaries. However, critics and legal experts warn the policy creates cyber privateers, introducing risks of misattribution, international escalation, and significant legal liability for participating firms. Some former officials noted the policy marks a reversal of positions held by senior cyber officials five months prior.