Trump signs memo authorizing private firms to run offensive cyber operations abroad

President Donald Trump signed a National Security Presidential Memorandum on August 12, 2026 authorizing vetted private US companies to conduct offensive cyber operations against foreign cyber-enabled criminal groups, under federal control and oversight. The directive, Expanding Capabilities to Combat Transnational Cyber-Enabled Crime, is described as the first time the US has formally sanctioned private-sector offensive hacking.

The memorandum permits approved firms to run what it calls ‘Cyber Surveillance Operations and Cyber Effects Operations’ against groups running ransomware, fraud, and sextortion campaigns against Americans from abroad. It builds on a March 2026 executive order focused on fraud.

Oversight runs through a new National Coordination Center, co-run by the Departments of Justice and Homeland Security, which will vet and authorize participating companies. Each firm must post a bond or escrow of at least $1 million, forfeitable for non-compliance. Implementation guidance is due within 60 days, and the program requires annual reviews.

The authorization has been likened to a modern-day ‘letter of marque’ for cyberspace — the centuries-old practice of licensing private actors to attack a state’s enemies, now pointed at criminal networks online.

The approach carries clear risk. Deputizing private companies to hack across borders raises questions about attribution, collateral damage to third-party systems, and how tightly a coordination center can control operations it does not run itself. The memorandum sets vetting and bonding requirements but leaves the operational details to guidance that has not yet been written.