Publication
White House Memorandum Establishes Framework for Private Sector Participation in Offensive Cyber Operations
By Emily Statham, James P. Melendres, and Tony Caldwell
On August 12, 2026, the Trump Administration issued a National Security Presidential Memorandum (NSPM) entitled Expanding Capabilities to Combat Transnational Cyber-Enabled Crime. The NSPM directs the federal government to establish a program (the “Cyber Program”) through which vetted private U.S. companies may, under federal supervision and authorization, assist the government in conducting cyber operations against foreign cyber-enabled transnational criminal organizations. Although the NSPM leaves many implementation details to forthcoming agency guidance, the Cyber Program represents a significant step toward integrating private-sector cyber capabilities into government-led efforts to identify, surveil, disrupt, and degrade foreign cybercriminal networks. And if the Cyber Program were to be implemented as contemplated, it could (1) create the first formal federal framework through which private companies are authorized to support government-directed offensive cyber operations against foreign criminal actors; and (2) provide significant new opportunities for cybersecurity vendors, incident response providers, threat intelligence firms, and other organizations possessing offensive cyber capabilities.
Program Overview
The NSPM directs the National Coordination Center (NCC) to establish the new Cyber Program designed to leverage private-sector capabilities in the fight against transnational cybercrime. The Cyber Program reflects the Trump Administration’s view that private companies possess technical expertise, operational agility, and cyber capabilities that have historically been underutilized in efforts to identify, investigate, and disrupt foreign cybercriminal organizations targeting U.S. individuals and businesses. Consistent with the Trump Administration’s broader cybersecurity strategy, the NSPM declares the Cyber Program to be U.S. policy to use “all instruments of national power, including the innovative capabilities of the private sector,” to combat cyber-enabled crime.
Under the draft framework established by the NSPM, approved private-sector participants (Participating Companies) may conduct certain cyber operations against foreign Cyber-Enabled Transnational Criminal Organizations (Cyber-TCOs) — but only under the direction, supervision, and legal authorities of the U.S. federal government. The Program is intended to support lawful law enforcement, intelligence, and protective operations rather than create an independent private-sector authority to engage in offensive cyber activity.
While many operational details remain subject to forthcoming implementing guidance, the Cyber Program lays the foundation for a formal public-private framework through which vetted companies may support government efforts to disrupt foreign cybercriminal organizations engaged in fraud, scams, ransomware, and other cyber-enabled criminal activity.
Program Governance
The NCC is responsible for establishing, managing, and maintaining the Cyber Program. The NSPM contemplates extensive coordination among law enforcement, Homeland Security, intelligence, defense, diplomatic, and other national-security stakeholders. Operational leadership of the Cyber Program will be shared by two Program Executive Directors, one designated by the Department of Justice (DOJ) and the other by the Department of Homeland Security (DHS).
Activities Contemplated by the NSPM
The Cyber Program describes two broad categories of activities that an approved Participating Company may undertake within a government-directed operation and subject to applicable approvals: Cyber Surveillance Operations and Cyber Effects Operations.
- Cyber Surveillance Operations involve activities intended to collect intelligence from targeted systems, networks, or infrastructure, including covert access and other actions necessary to facilitate intelligence collection. The precise scope of permissible surveillance activities will depend on the implementing procedures and operation-specific approvals established by the government.
- Cyber Effects Operations involve activities designed to manipulate, disrupt, deny, degrade, or destroy targeted systems, infrastructure, or data. These operations are likely to present the most significant legal and operational considerations because they may affect systems, data, or persons beyond the intended target if not carefully managed.
The NSPM provides that Cyber Program operations may be directed only at foreign Cyber-TCOs. It excludes organizations that are institutionally part of, or wholly directed and controlled by, a foreign government, and presumes that a target is not state-affiliated, absent clear intelligence demonstrating such a connection. The NSPM does not eliminate the need for operation-specific target validation, including when criminal groups use compromised, shared, or third-party infrastructure.
The NSPM further provides that all activities conducted through the Cyber Program must occur as part of lawful federal law-enforcement, protective, or intelligence operations and remain subject to federal oversight and control. In addition, the NSPM expressly requires compliance with the U.S. Constitution, applicable federal law, and the U.S.’ international obligations, specifically identifying the Computer Fraud and Abuse Act (CFAA) as one of the legal frameworks governing Program activities.
One critical implementation question is the extent to which participating companies will receive statutory authorization, derivative governmental authority, immunity, indemnification, or other legal protections for activities that might otherwise implicate federal computer crime laws.
Collectively, these limitations underscore that the Program is intended to serve as a targeted mechanism for disrupting foreign cybercriminal organizations within existing U.S. governmental authorities and approvals, rather than a broad authorization for private-sector offensive cyber operations.
Eligibility and Participating Company Requirements
To participate in the Cyber Program, Participating Companies must satisfy eligibility requirements that will be developed by DOJ and DHS. The NSPM provides that those requirements will include the following:
- Technical proficiency and demonstrated cyber operational experience;
- Facility security and personnel-vetting standards;
- Contractual agreements with DOJ or DHS;
- Disclosure of participating-company commercial relationships;
- Ongoing reporting obligations;
- Annual eligibility reviews; and
- Potential maintenance of a bond or escrow account of at least $1 million.
The NSPM specifically directs the government to establish standards that permit participation by both large cybersecurity providers and smaller specialized firms, recognizing that different organizations may offer distinct operational capabilities. Taken together, these requirements suggest that participation will be limited to organizations capable of meeting substantial operational, security, and compliance expectations.
Federal Oversight and Operational Safeguards
A central feature of the NSPM is its emphasis on federal oversight and operational control. Participating Companies are not granted independent authority to conduct offensive cyber operations. Instead, all activities must be conducted on behalf of, and under the supervision of, the federal government pursuant to government approval and direction.
The NSPM requires the development of detailed operating procedures governing every stage of the operational process, including target identification, operational review, interagency coordination, reporting, and post-operation assessment. The forthcoming implementation guidance must establish standardized procedures for preparing and reviewing operational packages, create an adjudicatory framework to ensure that activities are directed only at foreign Cyber-TCOs, and provide mechanisms for operational deconfliction across law enforcement, national security, intelligence, diplomatic, and military stakeholders. Although the NSPM requires target validation and operational review, the Cyber Program provides limited guidance regarding circumstances involving mixed-use infrastructure, compromised third-party systems, cloud environments, or situations where attribution of activity to a Cyber-TCO later proves incorrect. Future implementation guidance will likely need to address how such situations are investigated, approved, and remediated.
The NSPM also incorporates a number of safeguards intended to protect U.S. persons and domestic systems. Before any activity that could implicate constitutional, statutory, or international legal obligations may proceed, the operation must receive any required governmental or judicial authorization. In addition, Participating Companies must immediately cease and report any activity that exceeds approved parameters, including activity that unintentionally targets a U.S. person, a system located within the U.S., or a system controlled by a U.S. person. The NSPM further requires the immediate reporting of imminent cyberattacks targeting U.S. critical infrastructure and circumstances in which an approved operation could lead to specified “Critical Outcomes,” such as loss of life, serious injury, or effects that may rise to the level of a use of force under international law.
Perhaps most significantly, no operation may proceed without review and written approval from the Program Executive Directors. The NSPM specifically requires Program Executive Director review of every cyber operations package before action may be taken. These approval requirements, together with the reporting, minimization, and escalation procedures described above, are intended to provide legal and operational safeguards for what would otherwise be highly sensitive cyber activities.
Implementing Procedures and Timeline
DOJ and DHS have 60 days from issuance of the NSPM, or until approximately October 11, 2026, to develop detailed operating procedures for the Program. Among other things, those procedures must establish eligibility requirements for participating companies, operational approval processes, reporting obligations, target-review mechanisms, personnel-vetting standards, and safeguards designed to protect U.S. persons and domestic systems.
The implementing procedures must also address the potential requirement that Participating Companies maintain a bond or escrow account of at least $1 million; establish standardized target-identification and operational-review processes; and incorporate reporting, minimization, and annual reevaluation requirements. In addition, the procedures must conform to a classified annex accompanying the NSPM. The Program Executive Directors must submit an initial report regarding implementation of the Program within 180 days of the NSPM and annually thereafter.
Considerations for U.S. Companies Evaluating Program Participation
Companies that may possess relevant cybersecurity, threat-intelligence, or incident-response capabilities may want to consider the following areas as they evaluate whether and how to position themselves for potential participation in the Program:
- Understand the Scope of Authority and Oversight. The NSPM establishes only the Program’s high-level framework. Critical details regarding operational authority, approval processes, reporting obligations, and oversight mechanisms will be addressed through the forthcoming implementing procedures and contractual arrangements with DOJ or DHS. Companies should not assume that participation will confer independent authority to conduct cyber operations and may want to consider carefully evaluating the operational restrictions and government-direction requirements that ultimately accompany Program participation.
- Assess Operational Readiness. The NSPM signals that participating companies will be expected to satisfy rigorous technical, security, and personnel-vetting requirements. Organizations interested in participating may want to evaluate whether they possess the operational maturity, cybersecurity capabilities, internal controls, documentation practices, and staffing necessary to support government-directed cyber operations and comply with likely reporting, audit, and review requirements.
- Evaluate Contractual and Liability Considerations. Because participation will require a contractual relationship with DOJ or DHS, companies may want to consider carefully assessing issues such as scope of authorized activity, indemnification and liability allocation, insurance implications, audit and record-retention obligations, subcontractor restrictions, intellectual-property rights, termination provisions, and the proposed bond or escrow requirement. Depending on the nature of the activities involved, additional insurance, bonding, endorsements or specialized coverage may be necessary. The extent to which participants may receive legal protections or government support remains unclear and will likely be an important consideration for prospective participants. Participants may want to pay particular attention to the scope of authorized activities, indemnification mechanics, treatment of third-party claims, government-contractor defenses, classification obligations, incident-reporting requirements, audit rights, and allocation of responsibility when unintended effects occur.
- Consider Cross-Border Legal and Regulatory Risks. Even where operations are conducted under U.S. government supervision, participating companies may face complex issues arising under foreign law, export-control regulations, sanctions programs, and other cross-border legal regimes. Organizations may want to carefully assess how participation could affect their international operations, business relationships, and regulatory obligations.
- Establish Appropriate Governance and Risk Management Processes. Participation in government-directed cyber operations may present legal, operational, reputational, and regulatory risks that differ significantly from traditional cybersecurity services. Companies considering participation may want to evaluate whether appropriate board-level or senior-management oversight, escalation procedures, risk-management frameworks, and crisis-response processes are in place before seeking admission to the Program. Participating Companies may also consider evaluating whether Program participation constitutes a material enterprise risk requiring board-level review, committee oversight, or enhanced disclosure procedures. Participation in government-directed offensive cyber activities may implicate cybersecurity governance responsibilities, insurance coverage considerations, and public-company disclosure obligations.
What Comes Next
The next significant implementation milestone is the issuance of the operating procedures due by October 11, 2026. Those procedures are expected to establish the practical framework for Program participation, including eligibility requirements, operational approvals, deconfliction mechanisms, reporting obligations, target-review standards, security controls, and the contemplated bond or escrow requirements.
For now, the NSPM establishes the policy foundation for the Cyber Program but leaves many of the legal, operational, and contractual details unresolved. Until the implementing procedures are issued and agency agreements become available, prospective participants should not assume that the NSPM itself provides a complete framework for addressing issues arising under the CFAA, international law, or activities affecting third-party systems. Organizations interested in participating may want to consider using the interim period to assess operational readiness, evaluate governance and compliance capabilities, and prepare for engagement with DOJ and DHS as the Program moves toward implementation.
The NSPM signals a potentially significant shift in the federal government’s approach to public-private cybersecurity collaboration. For cybersecurity companies with advanced offensive, threat-intelligence, incident-response, and infrastructure-disruption capabilities, the forthcoming implementing procedures may create new opportunities to participate directly in government-led cyber operations. Organizations considering participation may want to begin evaluating operational readiness, governance structures, contractual requirements, and risk-management frameworks now, before the Program moves from policy concept to operational reality.
About Snell & Wilmer
Founded in 1938, Snell & Wilmer is a full-service business law firm with more than 500 attorneys practicing in 17 locations throughout the United States and in Mexico, including Phoenix and Tucson, Arizona; Los Angeles, Orange County, Palo Alto and San Diego, California; Denver, Colorado; Washington, D.C.; Boise, Idaho; Las Vegas and Reno-Tahoe, Nevada; Albuquerque, New Mexico; Portland, Oregon; Dallas, Texas; Salt Lake City, Utah; Seattle, Washington; and Los Cabos, Mexico. The firm represents clients ranging from large, publicly traded corporations to small businesses, individuals and entrepreneurs. For more information, visit swlaw.com.
