Trump Memo Authorizes Private Firms to Launch Cyberattacks on Foreign Crime Syndicates

Key points

• The memorandum directs the National Coordination Center to create a program allowing private companies to hack foreign cybercrime groups under U.S. government authority.
• Participating firms must sign contracts with the Department of Justice or Department of Homeland Security and maintain a bond or escrow of at least $1 million, forfeited for non-compliance.
• Operations are restricted to non-state criminal entities, excluding groups operating under foreign government direction, such as North Korean state hackers.
• The initiative aims to disrupt ransomware, phishing, and fraud schemes that cost U.S. consumers over $20.8 billion in 2025.
• Companies must immediately halt operations if they inadvertently target U.S. persons or domestic systems, with strict deconfliction procedures involving multiple federal agencies.

Background

This development follows a broader shift in U.S. cyber strategy, where the administration has previously called on the private sector to help disrupt foreign adversaries. In March 2026, the White House issued a national cyber strategy encouraging private sector cooperation, though it stopped short of authorizing direct offensive actions at that time. The current memorandum represents a significant escalation from that earlier guidance, moving from defensive collaboration to active offensive operations.

How outlets are covering it

BleepingComputer and SecurityWeek emphasize the structural safeguards of the new program, highlighting the $1 million bond requirement and the rigorous vetting process by the Justice and Homeland Security departments. They note that the memo explicitly prohibits operations that could cause loss of life or constitute a use of force under international law. Politico, however, frames the move as a potentially controversial expansion of private sector power, raising concerns about the difficulty in distinguishing between independent criminal gangs and state-sponsored actors, particularly in regions like Eastern Europe. While BleepingComputer cites industry figures like Chris Wysopal calling it a major policy shift, Politico highlights the legal complexities and the risk of accidental targeting of U.S. persons, noting that the memo does not preclude operations directed at U.S. persons if proper judicial authorization is obtained.

Why it matters

This policy marks a historic shift in U.S. cyber doctrine, blurring the lines between state and private actors in offensive cyber operations. By empowering private firms to conduct 'cyber effects operations,' the government seeks to leverage private sector speed and technical expertise to combat transnational crime. However, the move raises significant legal and ethical questions regarding accountability, the definition of 'use of force,' and the potential for unintended consequences in a complex global cyber landscape where state and non-state actors often overlap.

What to watch

The executive directors from the Justice and Homeland Security departments must establish consensus procedures with the White House Homeland Security Council within 60 days. These procedures will outline the specific steps for approving offensive hacking operations and ensuring compliance with U.S. law and international obligations. Companies will then undergo vetting before entering into contracts, with the first operations likely to target high-profile ransomware and fraud syndicates.