For the first time, US policy sets out a programme under which vetted private companies can take part in government-approved offensive cyber operations against foreign cybercrime groups, and most organisations will feel its effects through their security suppliers rather than by joining. President Trump signed the memorandum Expanding Capabilities to Combat Transnational Cyber-Enabled Crime on 12 August 2026. It directs a federal coordination centre to authorise "Participating Companies" to carry out cyber surveillance and cyber effects operations against foreign cyber-enabled transnational criminal organisations (CE-TCOs), under Department of Justice and Department of Homeland Security approval. This guide sets out what the memorandum says, what it does not authorise, the open legal questions law firms have flagged, and what CISOs, incident responders, managed security providers and counsel should do now. It does not cover offensive techniques.
Source note: provisions are taken from the memorandum text and fact sheet on whitehouse.gov and checked against analyses by Mayer Brown, Skadden, Cooley, Paul Weiss, Crowell and Wiley. The operating procedures and a classified annex were not public when this page was checked in November 2026. Confirm against the official text before relying on it. Compliance steps, decision guidance and checklists on this page are NHI Mgmt Group recommendations, not requirements of the text.
Key takeaways
- It is not a general licence to hack back. Only companies accepted into the programme, under contract with DOJ or DHS, may act, and each operation needs written approval and runs under federal supervision. Everyone else remains bound by the Computer Fraud and Abuse Act.
- Targets are narrow. Only foreign criminal groups that are not part of, or wholly directed by, a foreign government; such groups are presumed not state-linked unless clear intelligence shows otherwise.
- Hard limits and money at stake. No operation may be approved that is likely to cause loss of life, serious injury or a use of force under international law, and DOJ or DHS may require a bond or escrow of at least 1 million US dollars, forfeited for non-compliance.
- Key detail is still missing. Operating procedures were due within 60 days (about 11 October 2026) and the workflow sits in a classified annex; we found no public release of the procedures as of November 2026.
- Your supplier contracts are the practical exposure. Threat data you share with a security vendor could feed an operation proposal; ask your providers whether they intend to participate.
Status and timeline
| Date | Item | Status as of November 2026 |
|---|---|---|
| 6 March 2026 | Executive Order 14390 directing federal action against cyber-enabled crime | In force; the memorandum builds on it |
| 12 August 2026 | Presidential memorandum signed, with a White House fact sheet and a classified annex | Signed; directs executive agencies, creates no enforceable rights |
| About 11 October 2026 (60 days) | Program Executive Directors, with the Homeland Security Council, to set operating procedures | No public release found; Skadden (9 September) confirmed the deadline and that key details were unreleased |
| About 8 February 2027 (180 days), then annually | Status report to the Homeland Security Advisor and the National Cyber Director | Not yet due |
A presidential memorandum directs the executive branch. It does not amend statutes, so the CFAA, the Wiretap Act, state computer crime laws and foreign laws continue to apply. Implementation is "subject to the availability of appropriations", and Mayer Brown notes the memorandum provides no new funding.
How the programme works
The National Coordination Center (NCC) of the Homeland Security Task Force creates and runs the programme. Two co-Executive Directors, one designated by the Attorney General and one by the Secretary of Homeland Security, coordinate and give written approval for each operations package. Operations must be carried out "exclusively on behalf of and under the supervision of the Federal Government". Participating Companies sign agreements with DOJ or DHS that require vetting and adherence to the operating procedures. They may also make commercial agreements with private entities that supply threat information, and with federal, state, local, tribal and territorial agencies that identify CE-TCO threats, so that companies can propose operations to the NCC.
| Term (Section 4) | Definition in summary |
|---|---|
| Cyber Effects Operation | Activity in or through networks that results in the manipulation, disruption, denial, degradation or destruction of information systems or infrastructure |
| Cyber Surveillance Operation | Activity whose primary purpose is collecting information with intent to remain undetected, involving access without or beyond authorisation, including enabling actions such as temporary disruption without physical effects |
| Critical Outcomes | Actions likely to cause loss of life or serious injury, or to rise to a use of force or armed attack under international law; may not be approved |
| CE-TCO | A foreign group that conducts cyber-enabled crime against the US Government, a US person or US interests and is not an institutional part of, or wholly directed by, a foreign government |
| Participating Companies | Private US companies accepted into the programme and authorised to act under US Government direction |
| United States person | As defined in Executive Order 12333 |
The fact sheet names the harms the programme is aimed at: ransomware, phishing, financial fraud, sextortion and impersonation scams, and cites a White House figure that American consumers reported losing more than 20.8 billion US dollars to cyber-enabled crime in 2025. See the Cybercrime Ecosystem Guide.
What the operating procedures must contain
Section 3(a) lists what the procedures must cover, and the memorandum states that no operation may be approved unless it complies with them.
| Section | Requirement | Why it matters to outsiders |
|---|---|---|
| 3(a)(i) | Minimum standards: technical proficiency, proven performance, facility security, personnel vetting, reliability | Sets the bar a supplier must clear; ask to see evidence |
| 3(a)(ii) | Eligibility open to large companies and smaller, more agile firms | Smaller specialist providers may participate |
| 3(a)(iii) | Disclosure to the NCC of all commercial agreements under Section 2(a)(iii) | Your threat-sharing contract with a participant may be disclosed to the government |
| 3(a)(iv) | Bond or escrow of not less than 1 million US dollars may be required | Financial exposure for participants |
| 3(a)(v), (vi) | Operational workflow and deconfliction across law enforcement, State, Treasury, War, Justice and the Intelligence Community; adjudication so operations target only CE-TCOs | Set out in the classified annex; not public |
| 3(a)(vii), (viii) | Standard rubrics and templates for targeting and operations packages; reporting on CE-TCO activity | Intelligence from incidents may flow into these reports |
| 3(a)(ix) | DOJ review for activity affecting US persons or constitutional, federal or international obligations, with any judicial authorisation obtained before approval | US-hosted infrastructure triggers extra review |
| 3(a)(x) | Minimisation: stop, minimise and notify the NCC immediately if activity exceeds approved parameters, such as touching a US person or US-located system | Hosting and cloud providers may host CE-TCO infrastructure |
| 3(a)(xi) | Immediate notification of imminent attacks on US critical infrastructure or possible Critical Outcomes | A new reporting path for intelligence about attacks |
| 3(a)(xii) | Participants may still conduct other lawful defensive operations | Ordinary defence is unchanged |
| 3(a)(xiii), (xiv) | Annual evaluation of each participant; written approval of every operations package | No standing authority; each action is approved |
Open legal questions
- CFAA exemption for contractors: 18 U.S.C. 1030(f) exempts lawfully authorised investigative, protective or intelligence activity of government agencies. Skadden, Cooley and Paul Weiss all note it is unclear whether it reaches contractors, and warn against treating authorisation as a safe harbour.
- Civil claims: Crowell notes the absence of a civil safe harbour; victims of collateral disruption could bring CFAA civil, tort or intellectual property claims. Skadden adds Wiretap Act and state law exposure.
- No federal indemnity: the memorandum creates no enforceable rights against the United States, so protection depends on contract terms that are not yet public.
- State action: Mayer Brown and Paul Weiss flag that participants acting under government direction may be treated as state actors, bringing constitutional limits and possible warrant requirements.
- Foreign law and attribution: most countries criminalise unauthorised access, and a US contract gives no immunity abroad. Skadden notes the presumption that a target is not state-directed creates attribution risk if it is.
- Litigation discovery and retaliation: Crowell warns that prosecutions could require disclosure of proprietary tooling and that targets may retaliate against participants.
See the Budapest Convention and UN Cybercrime Convention Guide for the international framework.
What it means for organisations that do not participate
Most organisations will never apply. Their exposure comes through suppliers, shared data and infrastructure.
- Your own response is unchanged: Wiley stresses that the memorandum does not authorise private hack back. Access to an attacker's systems without authorisation remains a crime outside the programme. Keep response within your own environment.
- Active defence that reaches out: Crowell advises auditing canary tokens, honeypots and other active defence measures to confirm none reach beyond your own network. See the Deception Technology Guide.
- Security suppliers: ask managed security, threat intelligence and incident response providers whether they plan to participate, and how they separate that work from your engagement. Cooley flags the conflict between incident response and intelligence work.
- Data you share: Skadden advises checking whether information shared with a vendor could be used to propose an operation without your consent, and reviewing consent, notice, confidentiality and downstream use clauses.
- Hosting and cloud providers: CE-TCO infrastructure often sits on rented servers. Review terms of service and abuse handling for government-directed activity on your platform. See the Bulletproof Hosting guide.
- Retaliation planning: if a supplier or partner participates, consider whether retaliation against them could reach shared systems.
Where identity fits
Two identity points are concrete. First, threat intelligence a participant receives from customers often contains credentials, tokens and account identifiers taken from incidents; contracts should say whether such material can leave the engagement. Second, a participant's own operator accounts, tooling credentials and signing keys become high-value targets for retaliation and must sit under privileged access controls with short-lived elevation and full session logging. See the Privileged Access Management Guide.
Decision guidance for security companies
| Option | Benefits | Risks | Fits |
|---|---|---|---|
| Apply as a Participating Company | Government contracts; direct role against CE-TCOs | Bond forfeiture, unresolved civil and foreign liability, retaliation, discovery of tooling, customer conflicts | Firms with existing government work, cleared staff and strong legal support |
| Supply threat intelligence to a participant | Commercial revenue without operating | Contract disclosure to the NCC; customer consent and confidentiality obligations | Intelligence providers with clear customer data rights |
| Stay out and say so | No change in legal posture; clear to customers | Possible competitive pressure | Most MSSPs and incident response firms, especially with multinational clients |
Smaller firms should weigh the bond and legal cost against contract value. Firms with clients in many jurisdictions face the most foreign law exposure. Law firms advise completing legal review before signing any agreement and negotiating indemnity, abort conditions and government responsibility for targeting and attribution.
Implementation: what to do in the next 90 days
- Brief leadership (week 1): explain that the programme exists, that it does not authorise your organisation to act, and where supplier exposure lies.
- Supplier survey (weeks 1 to 4): ask each security supplier in writing whether it intends to participate or supply a participant, and how customer data would be used.
- Contract review (weeks 2 to 8): add clauses restricting use of your incident data for operations proposals without consent, and requiring notice of participation.
- Playbook update (weeks 4 to 8): add a decision point to incident response on who may share incident-derived intelligence, with whom and under what terms. See the NIST SP 800-61 Incident Response Guide.
- Active defence audit (weeks 4 to 12): confirm that canaries, honeypots and any automated response stay inside your network; disable any that call out to external systems you do not own.
- Watch for the procedures: assign someone to track publication of the operating procedures, then repeat steps 2 and 3 against the final terms. If a supplier joins and the risk is unacceptable, the rollback is contractual: invoke the clauses from step 3 or move the work.
Detection and measurement
- Supplier coverage: percentage of security suppliers that have answered the participation question in writing.
- Contract coverage: percentage of threat-sharing and incident response contracts with consent and downstream use clauses.
- Active defence reach: number of deception or response controls that make outbound connections beyond owned infrastructure (target zero).
- Retaliation signals: for participants and their partners, monitor for increases in targeted phishing, DDoS and credential attacks against operator identities.
- Policy currency: days since the incident response policy was checked against the latest programme documents.
Common failure patterns
- Reading the headlines as permission: treating the memorandum as a general hack back right and accessing an attacker's server during an incident. That remains unlawful outside the programme.
- Assuming a safe harbour: participants relying on authorisation without legal review of CFAA civil, state and foreign exposure.
- Unseen data flows: incident artefacts shared with a supplier ending up in an operations proposal without the customer knowing.
- Active defence that leaks out: beacons or tokens that execute on systems you do not own.
- Ignoring collateral systems: CE-TCO infrastructure frequently runs on compromised or rented servers owned by innocent parties, including in the United States, which the minimisation rule exists to protect.
Framework mapping
| Area | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 |
|---|---|---|
| Legal and regulatory requirements understood | GV.OC-03 | PM-9 Risk Management Strategy |
| Supplier participation and data use | GV.SC-07 | SR-6 Supplier Assessments and Reviews |
| Incident coordination and information sharing | RS.MA-01, RS.CO-02 | IR-4 Incident Handling; IR-6 Incident Reporting |
| Response playbooks | RS.MA-01 | IR-8 Incident Response Plan |
Practitioner checklist
- Read the memorandum text yourself and note that it binds agencies, not your organisation.
- Confirm in policy that staff may not access attacker infrastructure during incidents.
- Ask every security supplier in writing about participation.
- Add consent and downstream use clauses to threat-sharing and incident response contracts.
- Audit deception and automated response controls for reach beyond owned infrastructure.
- Update incident response playbooks with an intelligence-sharing decision point.
- Track the operating procedures and re-review contracts when they appear.
- Security firms: complete legal review before any application or agreement.
Standards and references
- The White House: Expanding Capabilities to Combat Transnational Cyber-Enabled Crime
- The White House: Fact Sheet on Expanding Capabilities to Combat Transnational Cyber-Enabled Crime
- Mayer Brown: Presidential Memorandum Authorizes Vetted Private Companies to Conduct Offensive Cyber Operations
- Skadden: Presidential Memorandum analysis
- Cooley: New Federal Program Deputizes Private Companies to Hack Back
- Paul Weiss: White House Establishes Program to Allow Private Sector Cyber Operations
- Crowell: License to Hack
- Wiley: Navigating the New Presidential Memorandum on Transnational Cyber-Enabled Crime
Related NHI Mgmt Group resources: Cybercrime Law Enforcement Takedowns Guide · US Federal Cybersecurity Executive Orders Guide · Deception Technology Guide · Third-Party Risk Management Guide. This guide summarises the August 2026 presidential memorandum and is not legal advice.