An August 12, 2026 presidential memorandum directs the creation of a program for vetted U.S. companies to assist federally controlled operations against foreign cyber-enabled criminal organizations. It does not create a general right to conduct independent hack-back operations.
The memorandum establishes a policy framework. Its publication alone does not identify participating companies or demonstrate that particular missions have started.
This overview separates the directive’s requirements from predictions about its practical impact.
Why the US Authorizes Private Cyber Operations Now
The new presidential memorandum authorizes vetted private firms to conduct cyber surveillance and disruption operations against foreign criminal groups under the direct supervision of the Department of Justice (DOJ) and the Department of Homeland Security (DHS).
According to the official directive, the primary targets of these combined operations are cyber-enabled transnational criminal organizations (CE-TCOs) that explicitly threaten American citizens, critical infrastructure, and domestic businesses. Instead of merely passing threat intelligence logs to the FBI, authorized private sector teams can now actively assist in dismantling criminal infrastructure.
The program will be centrally managed by the National Coordination Center (NCC). Two dedicated executive directors—representing the DOJ and DHS—will jointly supervise every single tactical package, ensuring that private entities do not operate as rogue cyber mercenaries.
Related Security Context: To understand the scale of the threat these groups pose, read our in-depth analysis on Nation State APT Tactics and Threat Monitoring, which details how these organizations map global infrastructure.
Surveillance vs. Effects Operations: Understanding the Scope
Private firms participating in the program are permitted to conduct two types of missions: covert Cyber Surveillance Operations to collect intelligence, and active Cyber Effects Operations designed to disrupt, degrade, or destroy foreign criminal networks and IT infrastructure.
While the authorization is historic, it is heavily regulated. The directive explicitly categorizes the allowed activities into two distinct operational tiers:
- Cyber Surveillance Operations: This involves covertly penetrating external computer systems, networks, and telecommunications infrastructure to gather intelligence. Crucially, the policy allows for “unauthorized access” to remain undetected while tracking adversary movements, which directly aids in planning future takedowns.
- Cyber Effects Operations: This is a highly active, offensive tier. Vetted private entities can be authorized to manipulate, deny, degrade, or completely destroy the server infrastructure managed by the criminal organizations.
However, the program does not give private firms a blank check for unrestricted “hack-back” retaliation. Every single action requires explicit, written approval from the government. The policy draws a strict red line: the program directors may not approve operations likely to cause loss of life or serious injury, or amount to a use of force or armed attack under international law.
Eligibility, Vetting, and Compliance Requirements
To participate, cybersecurity firms must sign strict contracts with the DOJ or DHS, undergo rigorous personnel security vetting, disclose all relevant commercial ties, and potentially maintain a $1 million escrow bond that can be forfeited for non-compliance.
Section 3(a)(ix) requires necessary legal authorization for activity directed at U.S. persons or implicating applicable legal obligations. Section 3(a)(x) requires an operation exceeding approved limits to cease, with minimization and immediate notification to the NCC.
For more detailed technical guidelines on federal cybersecurity frameworks, security professionals should consult the official White House Memo on Cyber-Enabled Crime.
Policy Impact & Operational Matrix
Faster disruption is a possible policy outcome, not an established result. Evaluating effectiveness requires implementation reports and evidence of actual operations.
| Operation Type | Authorized Actions | Limits and conditions |
|---|---|---|
| Surveillance | Covert intelligence gathering, tracking criminal infrastructure | Required legal authorization; stop activity exceeding approved parameters |
| Cyber Effects | Disrupting, degrading, or destroying criminal network assets | No director approval for defined Critical Outcomes |
| Administration | DOJ/DHS oversight; bond or escrow may be required | Independent “hack-back” without written federal approval |
Further Reading: For real-time updates on active vulnerabilities targeted by these foreign criminal groups, check our continuously updated 2026 CVE Vulnerabilities Security Hub.
Follow CyberUpdates365 on LinkedIn for publication updates.
Related guide: For broader context and related coverage, see our nation-state and APT threat guide.
Frequently Asked Questions (FAQ)
Can any private company hack back against attackers now?
No. Private companies cannot act independently. They must undergo rigorous federal vetting, sign strict contracts with the DOJ or DHS, and receive explicit written approval and direction from the Program Executive Directors before taking any action against foreign criminal networks.
What happens if a private firm accidentally targets a US citizen?
When activity exceeds approved parameters, including unintended U.S. targeting, section 3(a)(x) requires stopping that operation, minimization and immediate NCC notification. This should not be confused with a blanket statement that every operation implicating a U.S. person is prohibited.
Who is managing this new private cyber operations program?
The program is centrally managed by the National Coordination Center (NCC), with direct operational supervision provided jointly by two executive directors representing the Department of Justice (DOJ) and the Department of Homeland Security (DHS).
Source and correction note — September 29, 2026: This article summarizes the public memorandum. Earlier historical-first and independent-verification claims were removed, the domestic-targeting explanation was qualified, and a LinkedIn link previously labelled GitHub was corrected.
