Skadden, Arps, Slate, Meagher & Flom LLP and Affiliates

Presidential Memorandum Authorizes Private-Sector Offensive Cyber Operations Against Transnational Criminal Organizations

Skadden Publication / Cybersecurity and Data Privacy Update

David A. Simon William E. Ridgway Michael E. Leiter Brian J. Egan Joshua Silverstein Matthew Urfirer

Executive Summary

  • What’s new: On August 12, 2026, President Trump issued a National Security Presidential Memorandum establishing a program under which vetted U.S. companies may conduct government-authorized surveillance and disruption operations against identified foreign cyber-enabled transnational criminal organizations. 
  • Why it matters: The memorandum could significantly expand the private sector’s potential role in offensive cyber activity. It requires vetted companies to enter into contractual agreements with the Departments of Justice or Homeland Security under which they may conduct network intrusions, data collection, disruption and degradation operations against foreign criminal targets under federal direction and control. It also permits vetted companies to establish commercial relationships with private sector entities to receive threat information and propose cyber operations for government approval — potentially offering victims of cyberattacks a novel avenue for response.
  • What to do next: Businesses should consider carefully monitoring the forthcoming operating procedures, which must be developed by October 11, 2026, to assess implications for cybersecurity service providers, critical infrastructure operators and all U.S. companies targeted by foreign cyber criminals. Companies interested in contracting with the government to perform cyber operations should carefully assess the associated legal risks. Many of the network intrusion activities contemplated by the program remain unlawful in the U.S. and around the world, and participation in the program may carry substantial legal, operational and reputational risks.

__________

On August 12, 2026, President Donald Trump issued a National Security Presidential Memorandum (“Expanding Capabilities to Combat Transnational Cyber-Enabled Crime”) directing the establishment of a new program (the Program) under which vetted U.S. companies may conduct offensive cyber operations “against foreign Cyber-Enabled Transnational Criminal Organizations (CE-TCOs) under the control and oversight of the federal government.”

The memorandum represents a key step in implementing the Trump administration’s cyber policy agenda as outlined in the National Cyber Strategy and Executive Order 14390. The March 2026 National Cyber Strategy declared that the U.S. would increasingly leverage the private sector as part of a more offense-oriented approach to cybersecurity, and Executive Order 14390, “Combating Cybercrime, Fraud, and Predatory Schemes Against American Citizens,” directed relevant federal agencies, including both the Department of Justice (DOJ) and the Department of Homeland Security (DHS), to develop an action plan to integrate private-sector capabilities into efforts to detect, disrupt and deter cyber-enabled transnational criminal organizations.

Key Elements of the Program

Program Structure and Governance

The new memorandum builds on the Trump administration’s prior actions by directing the National Coordination Center (NCC) — an “operational command center” established to coordinate the actions of Homeland Security Task Forces — to “create, manage, and maintain” the Program. The purpose of the Program is to allow vetted U.S. companies (the Participating Companies) to execute “Cyber Surveillance Operations and Cyber Effects Operations against foreign CE-TCOs” under “the control and oversight of the Federal Government.” Cyber Surveillance Operations are activities intended to collect information or intelligence from information systems, networks or infrastructure. Cyber Effects Operations are activities that result in the “manipulation, disruption, denial, degradation, or destruction of information systems or information.”

Key structural elements of the Program include:

  • Approval process. The Program will be overseen by co-executive directors — one from DOJ and one from DHS. Cyber operations by Participating Companies may be approved only after coordination between the executive directors. The executive directors are not authorized to approve actions likely to result in serious injury or death or constitute a “use of force or armed attack under international law,” otherwise known as “Critical Outcomes.”
  • Contractual framework. Participating Companies must enter into contractual agreements with DOJ or DHS under which they will submit to “rigorous vetting” and adhere strictly to operational procedures. Participating Companies must also disclose to the NCC all commercial agreements established under the auspices of the Program.
  • Commercial agreements. Participating Companies may enter into commercial agreements with private-sector entities to receive threat information, and with federal, state, local, tribal and territorial agencies to receive information about CE-TCO threats. The information gathered from these arrangements may be used to inform a Participating Company’s proposal to the NCC for a government-directed operation. This provision may present a novel pathway to generate government-authorized operations responsive to private ransomware incursions or cyberattacks — a potential boon to victims and a substantial market opportunity for cybersecurity companies. Forthcoming procedures will need to clarify the operational roles and responsibilities of private entities, Participating Companies and government personnel. The memorandum contemplates operational involvement by both Participating Company and government personnel, and the precise division of roles remains to be clarified. It is important to note that neither the memorandum nor the Program independently permit cyberattack victims or Participating Companies to access, monitor or disrupt criminal information systems; operations conducted outside of the Program remain exposed to significant civil and criminal liability and operational risk.
  • Legal compliance. The memorandum requires that all Program activities comply with the Constitution, federal law, the “international obligations of the United States” and the Computer Fraud and Abuse Act (18 U.S.C. § 1030) (CFAA). The CFAA establishes criminal penalties and a private right of action for certain unauthorized access to computer systems, and largely prohibits the operations contemplated by the Program. Although Section 1030(f) provides that the CFAA does not prohibit lawfully authorized investigative, protective or intelligence activity of state or federal government agencies, it remains an open question whether and under what circumstances contractor activity would fall within this exception. Further, state analogues of the CFAA, and the prospect of civil litigation, caution against treating Program authorization as a categorical CFAA safe harbor.

Operating Procedures and Eligibility

Within 60 days of the memorandum’s issuance (i.e., by October 11, 2026), the Program executive directors are directed to establish “consensus operating procedures” to govern Program activities and ensure federal government oversight and control of operations. The memorandum, supplemented by a classified annex, outlines certain key requirements for the operating procedures, including:

  • Eligibility criteria. The Program must require Participating Companies to meet minimum standards relating to technical proficiency, a proven record of conducting cyber operations, facility and personnel security, competence, reliability, and other factors identified by the Program Executive Directors as “relevant or necessary for guaranteeing high confidence in a Participating Company’s ability to perform successfully.” The ultimate criteria must also enable participation by both large and small companies.
  • Financial assurance. DOJ or DHS may require a bond or escrow of at least $1 million, potentially forfeited for contractual noncompliance, as a condition of Program participation. Notably, there is no requirement that the operating procedures provide for a materiality threshold or cure period, giving substantial discretion to the federal government.
  • Company reporting requirements. The operating procedures must include requirements for Participating Companies to keep the NCC fully apprised of their operational activities and to help develop a greater understanding of targeted foreign CE-TCOs.
  • DOJ review. The operating procedures must provide for pre-authorized DOJ review to ensure that the necessary authorization, judicial or otherwise, is obtained for any Program activity “directed at a United States person or otherwise implicat[ing] the United States Government’s obligations.”
  • Cessation, minimization and notification requirements. If a Participating Company discovers that an operation has exceeded the parameters and restrictions of the Program executive directors’ authorization — for example, by unintentionally targeting a U.S. person, a U.S.-based information system or an information system controlled by a U.S. person — the Participating Company must immediately cease the operation, conduct minimization procedures with respect to U.S. person data and notify the NCC. Participating Companies must also “immediately notify the NCC ... if they discover an imminent cyberattack against U.S. critical infrastructure or develop a reasonable belief that an approved Cyber Effects Operation or Cyber Surveillance Operation may result in Critical Outcomes.”
  • Mandatory review and written approval. The Program executive directors must review and approve “every cyber operations package” before any activity commences.

Implications for Participating Companies

The Program could create a new market for cybersecurity services focused on offensive operations, including related commercial arrangements with third parties, but participation may create significant legal, operational and reputational risks.

Several laws may prohibit or restrict Program activities, and Participating Companies may not be entirely shielded from liability. Federal authorization and Program oversight may bear on criminal CFAA exposure but do not necessarily foreclose private claims under the CFAA or liability under the Wiretap Act or other federal laws. Separately, many U.S. state computer-crime and data-protection statutes may impose criminal or civil liability for certain Program activities. Depending on the state, the affected systems or persons and the scope of authorization, state liability may apply notwithstanding the Program’s authorization.

Foreign law presents significant and distinct legal risks. Many countries criminalize network intrusion activities and often enforce strict data privacy regulations. Participating Companies may face criminal prosecution, civil liability, sanctions, travel bans or regulatory action in foreign jurisdictions where the company operates or where systems or affected persons are located. U.S. authorization may not be recognized as a valid defense. This risk is highlighted by the July 2026 U.K. Supreme Court decision in Kingdom of Bahrain v. Shehabi, which determined that state immunity did not shield foreign hackers from civil liability for tortious conduct under U.K. law — regardless of whether the alleged operators were present in the U.K.

International law raises additional complex risks — even if the actions do not constitute an armed attack or use of force under the United Nations Charter. Despite the notorious challenge of attribution and the frequently opaque links between CE-TCOs and government sponsors, the memorandum presumes that a foreign CE-TCO is not part of, or wholly operated by, a foreign government absent clear contrary intelligence. This creates attribution and escalation risks if a target is state-directed, state-protected or used as a proxy. Government-directed contractor operations may be attributable to the U.S. under international law, creating potential state-responsibility risks. Beyond the potential reputational consequences associated with responsibility for what may be described as an internationally wrongful act, operations may expose Participating Companies to lawful countermeasures by foreign governments.

While the Program may offer substantial benefits to Participating Companies and their clients, the magnitude of the risks involved should not be underestimated. Companies interested in participating in the Program should consider:

  • Assessing the associated risks now, including exposure in foreign jurisdictions whose laws may prohibit or limit Program activities; harm to third-party infrastructure; gaps in insurance coverage; False Claims Act (FCA) liability and the risk of suspension or debarment; and obligations under sanctions, export-control, privacy and surveillance laws.
  • Conducting comprehensive legal assessments before entering into any agreements with DOJ or DHS related to the Program, with particular attention to the scope and enforceability of any government-provided liability protections across all relevant jurisdictions.
  • Seeking robust contractual protections for both the company and its personnel, subject to applicable federal law and the availability of appropriations, including indemnification and commitments by the government to support dismissal or other litigation defenses. Such protections should, to the greatest extent possible, extend to claims, judgments, settlements and regulatory actions in any jurisdiction arising from authorized conduct in connection with the Program.
  • Ensuring government responsibility for targeting and attribution determinations, requiring identification of the legal authority supporting each operation, and setting out detailed rules of engagement and abort conditions within the parameters of the authorized operation.
  • Establishing clear contractual terms defining a material breach of Program Requirements, requiring that forfeiture be causally tied to that breach, distinguishing immaterial technical deviations, and creating notice and appeal procedures for alleged Program violations.
  • Developing internal controls, segregation and governance procedures to mitigate the Program’s risks, including independent analyses of whether any required executive or judicial authorization is legally sufficient, especially for operations that implicate U.S. persons or information systems located in the U.S. or controlled by U.S. persons.

Looking Ahead

The presidential memorandum is a significant step in the Trump administration’s strategy to leverage private-sector capabilities for offensive cyber operations. The Program creates a formal mechanism for vetted private companies to participate in government-authorized surveillance, disruptive or destructive cyber activity. While its practical scope and commercial value remain uncertain, the Program could create opportunities for cybersecurity vendors and a novel channel to address cyberattacks. The memorandum and the Program it authorizes represent a notable shift toward a more offense-oriented cybersecurity approach.

In preparation for the further development of the Program, all companies should consider assessing whether their cybersecurity and incident response vendors intend to participate in the Program, and evaluating whether contractual safeguards and internal controls appropriately address consent, notice, internal approval, confidentiality, and limits on and insight into downstream use of company data. Companies can also assess whether information provided to a Participating Company could later inform a proposal or operation under the Program without company consent — and ensure that information shared cannot constitute participation in any Program operations. As additional details of the Program emerge, incident response playbooks may need to be updated to consider the circumstances, timing, method and responsible actor for sharing incident-derived intelligence with a Participating Company to propose a government-directed operation.

While key details have yet to be released, the Program should be understood as an emerging, novel and highly regulated potential option to supplement existing cybersecurity defensive practices. Those defensive practices — including internal controls, vulnerability management, incident response planning, business continuity and engagement with law enforcement — will remain critical aspects of a responsible cybersecurity program.

This memorandum is provided by Skadden, Arps, Slate, Meagher & Flom LLP and its affiliates for educational and informational purposes only and is not intended and should not be construed as legal advice. This memorandum is considered advertising under applicable state laws.

BACK TO TOP