On August 12, 2026, President Trump issued a memorandum directing the federal government to establish a program allowing vetted private-sector companies to conduct several types of cyber operations against foreign cyber-enabled transnational criminal organizations. The memorandum builds on the Administration’s broader cyber strategy and its stated goal of leveraging private-sector expertise to combat cybercrime.
Under the program, participating companies would contract with the Department of Justice or the Department of Homeland Security and would be authorized to conduct “Cyber Surveillance Operations” and “Cyber Effects Operations” against targets approved by the government. The memorandum defines those activities broadly to include both intelligence collection activities and operations that may disrupt, deny, degrade, or manipulate targeted systems.
Importantly, the memorandum does not appear to authorize private-sector companies to conduct independent “hack back” operations. Rather, authorized activities must be conducted pursuant to government approval, supervision, and operational control. Critical details of the program will be addressed through future implementing guidance.
Memorandum Channels Private-Sector Efforts through the National Coordination Center
The memorandum directs the National Coordination Center (NCC)—created by an earlier executive order issued by President Trump in January 2025 as a coordination hub for efforts against transnational criminal organizations—to establish a program through which vetted private-sector companies may conduct cyber surveillance and cyber effects operations against foreign cyber-enabled transnational criminal organizations. Participating companies must enter into contracts with either DOJ or DHS and will be subject to government vetting, oversight, and performance requirements.
Operationally, the program appears designed around a government-approval and “operational control” model. Participating companies may receive threat information from private-sector entities and from federal, state, local, tribal, and territorial agencies and use that information to develop proposed cyber operations. Those proposals are then submitted to the NCC for review. Before any operation may proceed, designated DOJ and DHS officials must review and approve the operation, and the memorandum requires written government authorization and direction before action is taken. Notably, the Program Executive Directors may not approve operations resulting in “Critical Outcomes,” which are those likely to cause loss of life or serious injury, or to rise to the level of a use of force or armed attack under international law.
Eligible targets are limited to nongovernmental entities and, specifically, to cyber-enabled transnational criminal organizations. Section 4(c) of the memorandum defines a cyber-enabled transnational criminal organization as a foreign group that is “not an institutional part of a foreign government or wholly operated under a foreign government’s direction.” This evaluation may prove difficult in practice, however, as establishing whether a group operates independently of a foreign government—rather than, for example, at its direction, whether publicly acknowledged or otherwise—may turn on the kind of high-fidelity intelligence that is often hard to collect. The memorandum attempts to address this issue by shifting the presumption in favor of nongovernmental affiliation, stating that a foreign group “will be assumed not” to be an institutional part of a foreign government or wholly operated under a foreign government’s direction “unless clear intelligence exists establishing such connection.”
The memorandum repeatedly emphasizes that any resulting cyber operations will be conducted on behalf of, and under the supervision of, the federal government. It further directs DOJ and DHS to issue implementing guidance within 60 days establishing eligibility standards, approval procedures, reporting requirements, operational safeguards, and oversight mechanisms. Many of the most significant details of how the program will function in practice will likely flow from that guidance.
New Memorandum Appears Consistent with Overall Trump Cyber Strategy
As we noted in March, the Administration’s cyber strategy signaled an interest in expanding the private sector’s role in supporting U.S. cyber objectives while stopping short of endorsing private-sector “hack back” authorities. The strategy contemplated greater public-private collaboration and potentially expanded opportunities for contractors supporting government cyber missions, but it did not suggest that companies would be authorized to conduct unilateral offensive cyber operations. Notably, the UK Supreme Court recently held in Kingdom of Bahrain v. Shehabi that foreign states carrying out hacking operations against individuals in the UK are not entitled to state immunity from tort claims. Together, these developments underscore general legal risk surrounding cross-border cyber activity and reinforce the importance of conducting such operations within clearly defined legal authorities and under government oversight.
The new memorandum appears consistent with that approach. Although it creates a formal structure for leveraging private-sector cyber capabilities, the program does not appear to authorize private offensive cyber operations in the commonly understood sense. Rather, nearly every aspect of the program is built around government contracts, government approval, and government direction and control. Participating companies operate pursuant to agreements with DOJ or DHS, submit proposed operations to government officials for review, and may act only after receiving federal authorization.
The memorandum may thus be better understood as establishing a specialized framework for contractor-supported cyber operations than as creating a private-sector “hack back” regime. Whether the program ultimately differs in a meaningful way from cyber-related contracting arrangements already available to the government will likely depend on the implementing guidance that DOJ and DHS are directed to develop over the coming months. Companies evaluating opportunities to participate in the program, support government cyber missions, or navigate the legal and regulatory risks associated with cyber operations should consult legal counsel early in the evaluation and consideration process.
WilmerHale will continue to monitor implementation of the memorandum and the forthcoming DOJ and DHS guidance.
