Trump Signs Order Letting Vetted US Companies Hack Foreign Cybercriminals

Cybercrime cost Americans $20.877 billion in 2025, according to the FBI's Internet Crime Complaint Center, up 26% from the year before. President Trump's answer, signed August 12, is to deputize private companies to hit back.

The National Security Presidential Memorandum, titled "Expanding Capabilities to Combat Transnational Cyber-Enabled Crime," sets up a program run out of the Homeland Security Task Force's National Coordination Center, according to Northeast Times and helpnetsecurity. Two executive directors, one picked by the Attorney General and one by the Secretary of Homeland Security, oversee it jointly.

A company applies, goes through what the memo calls "rigorous vetting," according to Legal Insurrection, and posts a bond or escrow of at least $1 million. Break the rules, lose the money. The firm can then gather intelligence from other businesses or state and local agencies and pitch operations to the coordination center.

Nothing happens without written sign-off. Every single operation needs approval and direction from both executive directors before a company can act, according to helpnetsecurity and The Record.

Two Kinds of Operations

The memo authorizes "Cyber Surveillance Operations," which means quietly accessing a target's systems without permission to collect intelligence, and "Cyber Effects Operations," which means actually disrupting, degrading or destroying enemy infrastructure. Targets are transnational criminal organizations running ransomware, phishing, sextortion and financial fraud schemes against Americans, not foreign governments.

There are hard lines. Operations can't cause what the memo calls "Critical Outcomes," meaning anything likely to kill or seriously injure someone, or that would count as an act of war under international law, according to The Record and helpnetsecurity. If a company accidentally hits a U.S. person or a U.S.-based system, it has to stop immediately and report it.

The detailed targeting rules sit in a classified annex, so the public version of the guardrails is thin on specifics, according to Northeast Times.

Why Now

This builds on a March 2026 executive order that pushed federal agencies toward more aggressive cybercrime enforcement. Crypto scams alone cost an estimated $80.7 billion this year, per Northeast Times, and federal agencies have already clawed back more than $25 million in cryptocurrency tied to investment and romance scams.

The math on government capacity is brutal. Former FBI Director Christopher Wray has said Chinese government-backed hackers outnumber FBI cyber personnel 50-to-1, a stat CNN cited from Cynthia Kaiser, a former senior FBI cyber official. Kaiser told CNN that private-sector help "allows the US to disrupt more groups and frees up agencies like FBI and Cyber Command to focus more on countering nation states like China."

Scammers move fast, use AI to make impersonation scams more convincing, and often operate from countries where U.S. law enforcement has zero reach. Private firms already sit on more real-time threat data than most government agencies. Letting them act on it, under supervision, could be effective if the guardrails hold.

The Risk

But the concern raised by critics deserves a fair hearing. Andrew Schoka, a former Army officer at U.S. Cyber Command, told CNN "the real risk is that you end up with a bunch of cyber privateers running around without any clear coordination or direction at the federal level." Deconfliction between agencies is already hard, he said, and adding private firms with more capability and speed makes it harder.

Chris Wysopal, co-founder of cybersecurity firm Veracode, told CNN he worries about operations going sideways, like hacking a foreign data center to hit scammers and accidentally knocking out a hospital. He also flagged that employees of participating companies who travel abroad could become targets for foreign governments looking to detain or question them.

Kaiser told CNN companies will want more clarity on liability protections before signing up. The government keeps operational control, but the memo puts private firms in the position of doing things that would violate federal computer fraud law without this authorization. The $1 million bond protects taxpayers. It doesn't protect the company's lawyers.

What's Missing From the Memo

The Record noted the memorandum is light on what happens when cybercriminal groups turn out to be tied to nation-states. State Department officials have said many Chinese gangs running Southeast Asian scam centers connect to Chinese government projects, and DOJ indictments have already implicated Cambodian and Myanmar government and military officials in romance-scam compounds. If a "criminal network" a company is authorized to hit turns out to have state fingerprints on it, the memo doesn't spell out what changes.

Congressman Bennie Thompson (D-Mississippi) offered comment to The Record on the plan, though the specifics of his position weren't detailed beyond his engagement with oversight questions.

DOJ and DHS are expected to release further implementation guidance. Until companies actually sign contracts and the first operations get approved, whether this produces disrupted scam networks or an international incident remains unanswered.