Navigating the New Presidential Memorandum on Transnational Cyber Enabled-Crime

August 14, 2026

A new White House National Security Presidential Memorandum (NSPM) shifts the United States’ approach to cyber operations and disrupting international cyber crime. On August 12, 2026, in Expanding Capabilities to Combat Transnational Cyber-Enabled Crime, the President directed the National Coordination Center (NCC) to create a federal program that will allow vetted U.S. cybersecurity companies to conduct government-supervised cyber surveillance and cyber disruption operations against Cyber Enabled Transnational Criminal Organizations (CE-TCO), while operating under Department of Justice (DOJ) and Department of Homeland Security (DHS) approval and oversight. The initiative is intended to leverage private-sector capabilities to combat cybercrime, fraud, and other malicious activity targeting U.S. persons and U.S. interests. The NSPM builds on Executive Order 14390 (March 6, 2026), Combating Cybercrime, Fraud, and Predatory Schemes Against American Citizens.

Key Takeaways

• The Administration is creating a first-of-its-kind framework for government-supervised offensive private-sector cyber operations. The NSPM directs DOJ and DHS to establish a program under which vetted U.S. cybersecurity companies may conduct approved cyber surveillance and cyber effects operations targeting cyber-enabled transnational criminal organizations (CE-TCOs).
• The memorandum does not authorize private-sector "hack back" activity. Participating companies may act only with express government approval, direction, and oversight, and all operations must be conducted pursuant to applicable legal authorities and established operational procedures.
• Significant implementation requirements remain to be defined. Within 60 days, DOJ and DHS must establish operating procedures, vetting requirements, operational approval processes, and other standards governing participation in the program.
• The initiative creates potential opportunities for cybersecurity service providers to work with government, but participation will come with substantial obligations. Participating companies can expect rigorous vetting, extensive government oversight, approval requirements for operational activities, compliance obligations, and continuing review of program participation or unintended consequences of authorized activities.
• Companies considering participation should begin evaluating government contracts and risk allocation issues now. Any contracts with the government will likely require careful consideration of liability allocation, indemnification, litigation support, operational authorities, bonding requirements, performance obligations, subcontracting arrangements, and compliance risks. Collaboration with the federal government on national security and surveillance issues has historically generated scrutiny and litigation risk, including from public disclosures about cooperation.

The NSPM expands the fight against TCO-perpetrated cybercrime by calling for use of the private sector’s immense innovative capabilities to secure an offensive cyber advantage. The specific offensive activities under the program are:

• Cyber Surveillance Operation defined as “actions essential and inherent to enabling Cyber Surveillance Operations, such as manipulation or temporary disruption that is not intended to cause physical effects or impact the usability of physical or virtual infrastructure.”
• Cyber Effects Operation defined as activity conducted through interdependent networks including the “Internet, telecommunications networks, computers, information systems, industrial control systems, networks, and embedded processors and controllers that results in manipulation, disruption, denial, degradation or destruction” thereof or information resident thereon.

The NSPM provides guardrails around operation of the program including:

• The NCC will establish a program to conduct Cyber Surveillance Operations and Cyber Effects Operations that disrupt foreign TCOs;
• The program will be operated by Executive Directors selected by DOJ and DHS;
• Partnering will be with vetted U.S. cybersecurity companies through contractual agreements (Participating Companies);
• Participating Companies will be authorized to receive threat information collected by contractually bound private sector companies;
• Executive Directors, in coordination with the Homeland Security Council, will establish consensus operating procedures and minimum standards within 60 days that require:
  
  • Government approval of all operations
  • $1 million bonds provided by Participating Companies
  • Notification by Participating Companies to the NCC, which shall notify DOJ, if they discover an imminent cyber-attack against United States critical infrastructure or develop a reasonable belief that an approved Cyber Effects Operation or Cyber Surveillance Operation may result in Critical Outcomes (loss of life or an event at the level of an armed attack)
  • Operational workflow of the program in conformance with a classified annex of the NSPM, including operational deconfliction across federal law enforcement, Department of State, Department of the Treasury, Department of War, DOJ, and the intelligence community
  • Procedures to ensure any program activity directed at a U.S. person receives necessary authorization
  • Clarification that Participating Companies may engage in otherwise lawful defensive cyber operations
  • Executive Directors to review and approve every cyber operations package
• The NCC is required to use automation to streamline program elements.

The NSPM addresses concerns regarding the Computer Fraud and Abuse Act (CFAA) by providing authorization for access through a government-approved and supervised process. However, the CFAA may remain a consideration for Participating Companies, as well as network operators, cloud providers, and other critical infrastructure operators with facilities where CE-TCOs may be operating, which makes the protections under this program essential.

Commercial Offensive Cyber Activities Raise Operational and Government Contract Issues That Require Careful Consideration

In discussions of proportional responses to repeated criminal cyber-attacks against U.S. interests, policymakers have considered various ways to permit “hack back” or letters of marque or reprisal. This Presidential Memorandum does not purport to authorize vigilantism or so-called “offensive” cyber capabilities by the private sector.

Cyber operations will only be approved after coordination between the program’s Executive Directors, and any resulting operational action will be conducted exclusively on behalf of, and under the supervision of, the U.S. government pursuant to the government's lawful authorities. To ensure that Participating Companies are acting under the control and oversight of the government, the NSPM provides that all program activities must be conducted in accordance with the U.S. Constitution and all applicable laws and international obligations, including the Computer Fraud and Abuse Act, 18 U.S.C. § 1030, et seq. The NSPM seems to avoid authorizing private-sector "hack back" operations, as express written approval of the U.S. government is required before Cyber Effects Operations may be conducted.

The Memorandum appears to be a further extension of the Trump Administration's efforts to conduct cyber operations in ways that were previously considered off-limits to the private sector and echoes, in many respects, the review and approval process established by National Security Presidential Memorandum 13, United States Cyber Operations Policy (Aug. 2018), for offensive cyber operations conducted by the Department of War. While NSPM-13 focused on delegating the Secretary of War's Title 10 authorities to facilitate agile offensive cyber operations by U.S. Cyber Command, this NSPM provides an avenue for commercial cybersecurity firms to conduct cyber surveillance operations and cyber effects operations against transnational criminal organizations with the express approval of, and under the strict supervision of, the U.S. government.

The NSPM's approach is particularly noteworthy because the authority for commercial cybersecurity firms to engage in these activities is premised on entering into agreements with the U.S. government. The details of participation are to be worked out by the agencies, who may welcome input on this program. As a result, companies considering participation should carefully evaluate a number of government contracts, compliance, and risk-allocation considerations, including:

• Program participation and vetting. The NSPM envisions that participating companies will enter into contractual agreements with DOJ or DHS and undergo "rigorous vetting." We expect administering agencies to develop requirements relating to past performance, compliance programs, facility clearances, cybersecurity certifications, and other qualifications which may include geographical and operational restrictions or commitments. The NSPM also calls for at least annual review of each company's continued participation in the program, although the review criteria and performance metrics remain unclear.
• Subcontracting and teaming arrangements. Notably, the NSPM also requires disclosure of "all contractual relationships" entered into for the purpose of providing services, a potentially broader requirement than traditional subcontractor disclosures. This suggests that nondisclosure agreements, teaming agreements, subcontracts, and other support arrangements may play a significant role in program participation.
• Indemnification and liability protections. Companies should carefully consider whether participation agreements adequately address indemnification, legal representation in litigation arising from approved activities, and other protections associated with conducting government-directed cyber operations. Past experience with private-sector support for national security and surveillance activities suggests that it will be important to try to get an understanding in advance whether the government will protect participants, such as through invocation of the state secrets doctrine or other privileges.
• Operational approvals and oversight. Participating companies should ensure they receive and maintain adequate documentation of government approval for each authorized activity. The NSPM requires review of every cyber operations package and written approval before action may be taken, suggesting that contractual agreements will incorporate extensive approval, reporting, and oversight mechanisms. How that is operationalized remains to be seen.

• Bonding requirements and contractual non-compliance. The NSPM contemplates that participating companies will provide a bond or escrow that may be forfeited if the company enters "non-compliance" with its contractual agreement. Because "non-compliance" is not defined, contractors should closely review implementing agreements and seek clarification regarding the conduct that could trigger forfeiture.

• Government-directed performance obligations. Companies should carefully evaluate the consequences of declining to perform an approved activity or otherwise failing to comply with government direction under the Program.

***

The NSPM is a key step in involving the private sector more in cyber surveillance and cyber effects operations to combat TCOs. Numerous companies support cyber and operational missions of the federal government, but this move invites more and different collaboration. As the U.S. government formulates implementation guidance, it will be interesting to see if, and to what extent, the government solicits input from the commercial cybersecurity community and its existing service providers. Such participation may be critical to ensuring that the program’s eligibility criteria and protections enable participation by large companies and the smaller, more agile companies the government believes may be better suited for specialized or discrete tasks. It is also unclear how the prospects for long-term reauthorization of the Cybersecurity Information Sharing Act of 2015, which has been temporarily extended, may impact the willingness of private sector partners to work within the NSPM’s construct.

Wiley’s Privacy, Cyber & Data Governance, Cybersecurity, and Government Contracts practices advise technology, defense, telecom, and critical infrastructure clients on national security, cybersecurity compliance, procurement obligations, risk management, and evolving regulatory and policy developments. Our attorneys draw on extensive experience in law enforcement and the U.S. Intelligence Community, including developing and implementing public-private partnerships and addressing complex cyber, legal, and operational challenges. We also engage regularly with key government stakeholders shaping these rapidly evolving areas and have helped organizations of all sizes proactively navigate emerging risks and government authorities. Please reach out to any of the authors with questions.