Trump Authorizes Private Firms for Cyber Operations Against Foreign Criminals

Key Takeaways

• President Trump has enacted a new policy allowing private companies to engage in government-sanctioned cyber operations against foreign criminal organizations.
• The initiative targets “cyber-enabled transnational criminal organizations” (CE-TCOs) responsible for online crimes affecting American individuals and businesses.
• Private firms will conduct cyber surveillance and cyber effects operations under strict federal government direction and oversight.
• The program emphasizes stringent controls, prohibiting actions causing death, serious injury, or those considered an act of war under international law.

President Donald Trump has signed a presidential memorandum establishing a framework for private sector involvement in government-led cyber operations targeting international criminal groups. This landmark policy aims to bolster the nation’s ability to counter sophisticated online threats originating beyond U.S. borders.

The new directive specifically addresses cyber-enabled transnational criminal organizations (CE-TCOs), entities accused of perpetrating cybercrimes that inflict harm upon American citizens and businesses. Under the memorandum, the National Coordination Center (NCC) is tasked with the crucial responsibility of developing and overseeing this unprecedented program.

Companies participating in this initiative will be authorized to undertake both cyber surveillance and cyber effects operations. However, their involvement is strictly conditioned upon direct instruction, control, and supervision from the federal government, ensuring all actions align with national interests and legal parameters.

Joint oversight of the program will be provided by the Department of Justice and the Department of Homeland Security, with two program executive directors appointed to manage the collaborative effort.

Defining Cyber Operations

The memorandum meticulously defines the scope of permissible activities. “Cyber surveillance operations” are characterized as covert actions designed to gather intelligence from various digital assets, including computer systems, networks, telecommunications infrastructure, and embedded devices. This definition explicitly includes gaining unauthorized access or exceeding authorized access to maintain stealth and collect information, which may subsequently inform future operations.

In contrast, “cyber effects operations” possess a more active objective. These operations are intended to manipulate, disrupt, deny, degrade, or destroy information, systems, networks, or infrastructure managed through information technology. The intent here is to actively counteract or neutralize the capabilities of target criminal organizations.

Crucially, the memorandum establishes clear boundaries regarding actions with potentially severe consequences. It explicitly prohibits actions likely to result in death, serious injury, or any effect that could be construed as a use of force or armed attack under international law. Such “critical outcomes” cannot be authorized by the program executive directors, reinforcing that the program does not grant companies carte blanche for “hack-back” activities.

Operational Framework and Oversight

Before any action is initiated, every proposed operation package must undergo thorough review and receive explicit written approval and direction. This ensures that participating companies operate solely on behalf of the government and under its lawful authority.

The NCC is further mandated to facilitate coordination across various federal entities, including law enforcement and intelligence agencies, as well as departments responsible for foreign policy, treasury, and defense. This multi-agency approach aims to ensure comprehensive strategic alignment and avoid conflicts.

To qualify for participation, companies must secure contracts with either the Department of Justice or the Department of Homeland Security. They will be subjected to rigorous technical, security, and personnel vetting processes. Future operating procedures are designed to accommodate both large-scale providers and smaller, specialized firms, allowing for a diverse range of expertise.

Participating companies are required to disclose all relevant commercial relationships and may need to maintain a bond or escrow of at least $1 million. This financial safeguard can be forfeited in instances of non-compliance, adding a layer of accountability.

As reported by White House reports, the policy mandates that companies immediately cease operations, minimize collected data, and notify the NCC if they inadvertently target a U.S. person or system. Furthermore, any operation implicating constitutional, federal, or international-law obligations must undergo a Justice Department review and receive all necessary legal or judicial authorizations prior to approval.

The program executive directors have been given 60 days to finalize operating procedures in conjunction with the Homeland Security Council. They are also required to submit an initial report on the program within 180 days, followed by annual reports thereafter, ensuring ongoing transparency and accountability.

What You Should Do

• For cybersecurity defenders and threat intelligence teams, this development could signify a formalized channel for sharing threat data collected by businesses and potentially proposing government-supervised disruption of criminal infrastructure.
• Monitor official announcements and guidelines from the NCC, Department of Justice, and Department of Homeland Security for details on program implementation and any potential classified workflows, target rules, legal reviews, and selection criteria for participating firms.
• Understand that the practical impact of this policy will depend heavily on the specific operational procedures and the selection of participating firms.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.