White House memo authorizes private firms to conduct cyber operations against transnational criminal groups

On August 12, a new Presidential Memorandum authorized the federal government to deputize vetted private corporations to conduct activities in support of law enforcement operations against cyber-enabled transnational criminal organizations. The move represents an innovative response to a scourge of cybercrime that costs Americans billions of dollars annually. However, it also introduces legal risks that no company has previously been asked to bear—and that no court has yet tested.

The Scale of the Problem

According to the White House's fact sheet accompanying the memorandum, Americans reported losing over $20.8 billion to cyber-enabled crime in 2025, including:

• Ransomware
• Phishing
• Financial fraud
• Sextortion
• Impersonation schemes online

Additionally, 73% of U.S. adults report having experienced an online scam or attack. Seniors, children, and low-income families are disproportionately targeted.

Many of the cyber-enabled transnational criminal organizations (CE-TCOs) behind these scams originate abroad, and U.S. law enforcement cannot reach them quickly enough. While private sector capabilities are often better equipped to respond, they are typically barred by law from touching attackers' systems. The Computer Fraud and Abuse Act (CFAA), enacted in 1986, criminalizes accessing a computer "without authorization" and knowingly transmitting code that intentionally causes damage. Its drafters could not have foreseen today's challenges of combating cybercrime.

What the Cybercrime Memo Authorizes Private Firms to Do

The memorandum creates a framework for private firms to conduct cyber surveillance operations and cyber effects operations against CE-TCOs under federal government contract and supervision.

Definition of CE-TCO

The memo defines a CE-TCO as:

"Any foreign group that conducts cyber-enabled crime against the United States Government, a United States person, or United States interests, and that is not an institutional part of a foreign government or wholly operated under a foreign government's direction."

This definition appears designed to keep participating firms focused on criminal enterprises and out of interstate conflicts.

The Program

The National Coordination Center (NCC) —initially created by the Trump administration for immigration enforcement—will create and manage "the Program." After rigorous vetting, companies accepted into the Program will be authorized to conduct two types of cyber operations under the contract and direction of the Departments of Justice or Homeland Security:

• Cyber Surveillance Operations: Discreetly collect information and intelligence, involving unauthorized access of information systems.
• Cyber Effects Operations: Produce "manipulation, disruption, denial, degradation, or destruction" of information systems, networks, or infrastructure.

Firms in the Program may receive threat information from other private entities and from federal, state, local, tribal, and territorial agencies, and may propose operations to the NCC.

The memo states that the Program will be conducted in accordance with the CFAA, implying that it falls under the Act's exception for "lawfully authorized investigative, protective, or intelligence activity," because firms act under government control and oversight.

Clarification: Not "Privateers"

Some commentators have incorrectly characterized the memo as authorizing cyber letters of marque or privateers. Key distinctions include:

• The Constitution grants Congress power to assign letters of marque, not the President.
• Firms in the Program can propose but do not select their own targets.
• Operations require a federal contract and written government approval to proceed.
• Congressional notification and approval are absent from the memo.

The Program's only reporting requirement runs to the Homeland Security Advisor and the National Cyber Director. This will likely raise alarm in a Congress already debating operations in Iran.

Safeguards

The memo includes important safeguards designed to ensure that private firms act lawfully and under government direction. Directors from both the Department of Homeland Security and the Department of Justice will oversee the Program.