Presidential Memorandum Authorizes Vetted Private Companies to Conduct Offensive Cyber Operations Against Foreign Criminal Organizations

On August 12, 2026, President Donald Trump signed a National Security Presidential Memorandum, Expanding Capabilities to Combat Transnational Cyber-Enabled Crime (the “NSPM”). The NSPM directs the creation of a program (the “Program”) under which vetted private United States contractors (“Participating Companies”) will be authorized to conduct cyber surveillance and cyber effects operations against foreign cyber-enabled transnational criminal organizations (“CE-TCOs”), under the direction, control, and oversight of the federal government.

Accompanied by a White House fact sheet and a classified annex, the NSPM is the most significant step to date implementing the first pillar of the President’s national cyber strategy’s policy, Shaping Adversary Behavior, which, as discussed in our prior Legal Update, promised to “unleash the private-sector” to “disrupt adversary networks.”

Background

The NSPM builds on Executive Order 14390 of March 6, 2026 (Combating Cybercrime, Fraud, and Predatory Schemes Against American Citizens), which directed a government-wide campaign against cyber-enabled fraud targeting American citizens, and on the Department of Justice’s broader redirection of enforcement resources toward transnational criminal organizations. Mayer Brown previously discussed Executive Order 14390 alongside the Administration’s national cyber strategy.

The NSPM’s premise is that “American businesses’ innovative capabilities have historically been underutilized in efforts to identify and disrupt criminal networks operating in cyberspace,” and that the scale, speed, and capacity of the United States private sector will “secure a critical offensive cyber advantage for the United States.” It accordingly declares a policy of using “all instruments of national power, including the innovative capabilities of the private sector, to combat cybercrime.”

Structure of the Program

Section 2 of the NSPM directs the National Coordination Center (“NCC”)—the entity established under section 6(d) of Executive Order 14159 of January 20, 2025 (Protecting the American People Against Invasion) and situated within the Homeland Security Task Force—to create, manage, and maintain the Program.

The Program includes:

• Program Executive Directors: The Program is overseen by two Program Executive Directors, one designated by the Attorney General and one designated by the Secretary of Homeland Security. Operations may be approved only after coordination between them, and every cyber operations package must receive their written approval and direction before action may be taken.
• Government control: Any resulting operational action is to be conducted “exclusively on behalf of and under the supervision of the Federal Government” pursuant to the government’s lawful authorities, as part of lawful investigatory, protective, or intelligence operations carried out by Federal law enforcement.
• Contractual gateway: Participating Companies must enter into contractual agreements with the Department of Justice or the Department of Homeland Security that impose rigorous vetting and adherence to the Program’s operating procedures.
• Commercial agreements: Participating Companies may contract with other private entities to receive threat information collected in the course of those entities’ normal business activities, and with federal, state, local, tribal, and territorial agencies that identify CE-TCO threats, in each case for the purpose of proposing responsive cyber operations to the NCC.
• Legal guardrails: The NCC must conduct all Program activities in accordance with the Constitution, applicable law, and US international obligations, including 18 U.S.C. § 1030, the Computer Fraud and Abuse Act. However, the NSPM frames Program activity as occurring “as part of lawful investigatory, protective, or intelligence operations carried out by Federal law enforcement”—language drawn from section 1030(f) that permits unauthorized access to computers by agents of a federal law enforcement or intelligence agency.

Within 60 days, the Executive Directors must issue operating procedures that, among other things, set standards for Participating Companies, provide for deconfliction of operations across the federal government, and establish other operational guardrails.

Contemplated Operations

The NSPM authorizes two categories of operations against qualifying targets. The first, “Cyber Effects Operations,” are offensive actions conducted through information technology infrastructure (including the internet, telecommunications networks, computers, industrial control systems, and embedded processors) that manipulate, disrupt, deny, degrade, or destroy targeted systems, networks, the physical or virtual infrastructure those systems control, or the data residing on them.

The second category is “Cyber Surveillance Operations,” which are comprised of intelligence-collection activities conducted through the same infrastructure, carried out with the intent to remain undetected, and involving unauthorized access to information systems or access that exceeds what has been authorized. Surveillance operations may include incidental manipulation or temporary disruption necessary to enable the collection, so long as it is not intended to cause physical effects or impair the usability of infrastructure. These authorities may be directed only at a “CE-TCO”—a foreign group that conducts cyber-enabled crime against the US government, US persons, or US interests, and that is not an institutional part of, or wholly operated under the direction of, a foreign government. Notably, however, a foreign group is presumed to fall outside government control unless clear intelligence establishes otherwise. The NSPM draws one hard boundary: operations likely to result in loss of life, serious injury, or conduct rising to the level of a use of force or armed attack under international law, deemed “Critical Outcomes,” may not be approved.

Open Questions

• Participating companies as state actors: Because Participating Companies would act under the direction, control, and supervision of the Federal Government, their conduct would be attributed to the Government. That implicates the Fourth and First Amendments, civil rights statutes, and surveillance laws—including whether collection under the Program constitutes “electronic surveillance” within the meaning of the Foreign Intelligence Surveillance Act, or otherwise requires a court order or warrant. Section 3’s requirement that activity directed at a United States person or otherwise implicating constitutional, Federal, or international law obligations receive “any necessary authorization, judicial or otherwise,” appears to reflect that.
• Who conducts the operation? Section 2 delegates to the Program Executive Directors authority to approve cyber operations conducted within the Program “by personnel of their respective departments,” suggesting that Participating Companies themselves will not conduct the operations. The operating procedures may clarify whether companies execute operations themselves or instead develop capabilities, propose targets, and support operations executed by Department of Justice and Department of Homeland Security personnel, a distinction with significant consequences for liability exposure, contract structure, and personnel security requirements.
• Extraterritorial collection and international law? Operations against foreign CE-TCOs will likely involve activities outside the United States, which have more frequently been undertaken by the Intelligence Community under classified authorities rather than unilaterally by law enforcement. The NSPM’s reference to United States international obligations, together with the deconfliction role assigned to the Departments of State, the Treasury, War, and Justice and to the Intelligence Community, suggest that the federal government will develop nonpublic procedures governing how to square these operations with foreign sovereignty and diplomatic equities.

Key Takeaways

The NSPM’s ultimate impact will depend significantly on the operating procedures to be issued within 60 days. It creates no new funding, so implementation is subject to the availability of appropriations. Because the Government already contracts for cyber capability development and operational support, and because Program activity is to be conducted on the Government’s behalf under its own authorities, an open question is how the Program will increase the volume of operations against criminal actors.

Companies considering participation should closely monitor the operating procedures and engage early with counsel to assess eligibility, compliance requirements, and risk exposure, including the consequences of acting as an agent of the Federal Government, the authorization regime that will govern collection, and how the required contractual agreements allocate liability for operations that exceed approved parameters. The Program also warrants attention from companies that hold threat information relevant to the Program’s mission, as the commercial agreement provisions create potential pathways for selling such data to Participating Companies.