The White House has authorized federal law enforcement agencies to collaborate with private firms in conducting offensive cyber strikes on foreign threat actors targeting the US.
The National Security Presidential Memorandum (NSPM), signed by President Donald Trump on August 12, builds on an Executive Order released in March, which directed government agencies to take “rigorous actions” to combat cyber-enabled crime targeting Americans.
The NSPM noted how despite the American private sector being “the most innovative and technologically advanced in the world” its innovative capabilities have “historically been underutilized” in efforts to identify and disrupt criminal networks operating in cyberspace.
The memorandum facilitates the involvement of the private sector in such tactics.
The Homeland Security Task Force’s National Coordination Center (NCC) will set up a program to oversee these operations, which will be headed up by two Executive Directors from the Department of Justice and the Department of Homeland Security.
The NSPM has established a framework in which private sector companies that wish to participate can enter into agreements with other firms as well as federal, state and local government bodies to gather threat intelligence on transnational cybercrime groups and propose cyber operations designed to disrupt the actions of those threat actors.
The memorandum said that “rigorous procedures” will be established for the review and conduct of “limited” cyber operations, which will only be conducted under the direction of the US government.
It added that the program will ensure it complies with the US Constitution and laws, as well as relevant international agreements.
The White House argued that “every available tool” should be deployed against transnational cyber threats, given the huge damage attacks are having against American businesses and individuals.
It highlighted figures showing that American consumers reported losing more than $20.8bn to cyber-enabled crime in 2025, while 73% of U.S. adults have experienced some kind of online scam or attack.
Cybersecurity Community Reacts to the Trump Memorandum
While some cybersecurity professionals have welcomed the White House’s expansion of public-private collaboration in offensive cyber operations, others have raised concerns about the evolved approach.
Commenting on the memorandum on X, Chris Wysopal, co-founder at Veracode, described the policy as a “big shift” in US cyber policy.
“Not exactly ‘hack back,’ but definitely a major expansion of the private sector’s role in offensive cyber operations,” he wrote.
However, some members of the cybersecurity community have raised concerns about the risks involved in launching offensive cyber strikes, particularly regarding private sector involvement in the process.
This includes the possibility of targets being wrongly identified, and for potential escalation of cyber hostilities rather than acting as a deterrent.
Nick Carr, technical director for the Microsoft Threat Intelligence Center (MSTIC) team and former chief technical analyst at the Cybersecurity and Infrastructure Security Agency (CISA), highlighted the difficulties in accurately identifying perpetrators of cybercrime.
“My biggest concern with private sector offensive action vs crime – having run the global cybercrime & ransomware intelligence team for almost four years – is just how difficult attribution in criminal operations is, and how few organizations can repeatably do it right (including certain gov agencies). People are regularly and willingly wrong on pretty important incidents,” he wrote on X.
He added that such issues could be mitigated by the new program being designed to ensure improved attribution work.
Dr Lukasz Olejnik, an independent researcher and consultant in cybersecurity and privacy, warned on X that the license to destroy cyber-controlled infrastructure could impact state-linked systems, raising the risk of interstate escalation and conflict.
The UK has also moved towards facilitating offensive cyber action to disrupt and deter cybercriminal groups with the creation of the National Cyber Force (NCF) in 2020.
In 2023, the UK government published principles on how the NCF uses such capabilities and emphasized that it would rarely deploy them where other responses are better suited to deal with the challenge effectively.
Image credit: Joshua Sukoff / Shutterstock.com
