Most of the time, when I warn you about cybercriminals, I focus on how you can stop them before they get into your accounts or steal your money. Now the U.S. government wants to take the fight closer to some foreign criminal organizations behind cyber-enabled crime. Earlier this month, President Donald Trump signed a National Security Presidential Memorandum that creates a framework for vetted private U.S. companies to conduct cyber operations against certain foreign criminal groups. The federal government would direct and oversee those operations.
The memorandum allows two broad types of activity. Companies could secretly collect intelligence from targeted computer systems. With federal approval, they could also manipulate, disrupt, deny access to, degrade or destroy systems and digital infrastructure that targeted criminal organizations control. So, what could these companies actually do, and what could this new approach mean for you?
New! Free live CyberGuy class: Protect Your Money From Today’s Biggest Threats
Join us on Saturday, Aug, 29, at 10 a.m. ET for a free CyberGuy LIVE class covering five simple steps to help defend yourself against AI scams, fraud, identity theft and financial hacks. Kurt “CyberGuy” Knutsson will explain how to set up bank alerts, strengthen your account logins, protect your phone number, freeze your credit and help secure your retirement savings against unauthorized transfers. No technical experience is needed. You’ll also receive our financial protection checklist, and every registrant will get a link to the class recording afterward.
Reserve your free spot today at CyberGuyLive.com.
FRAUD EXPERT WARNS AI IS HELPING CRIMINALS OUTPACE THE GOVERNMENT: ‘DON’T HAVE THE RIGHT TOOLS’
Cybercrime continues to cost Americans staggering amounts of money. The FBI’s Internet Crime Complaint Center received 1,008,597 complaints in 2025, with reported losses reaching $20.877 billion. Those losses were up 26% from 2024. The White House says foreign-based criminal organizations are responsible for sophisticated campaigns involving ransomware, phishing, financial fraud and impersonation scams targeting Americans and U.S. interests.
Technology is making some of those attacks increasingly difficult to recognize. As I’ve previously reported, AI is helping criminals create more convincing impersonation scams and other cyberattacks. Stolen personal information can also keep circulating after the original crime. That is one reason identity theft victims may find themselves targeted again. The new program is designed to give the federal government another way to pursue certain foreign criminal organizations involved in cyber-enabled crime.
[EMBARGO] META LEADS LARGEST-EVER ANTI-SCAM OPERATION WITH FBI AND DOJ, RESULTING IN 63 ARRESTS
The memorandum establishes two broad types of operations that participating companies could conduct under federal authority. One is called a Cyber Surveillance Operation. That can involve secretly accessing targeted computer systems to collect information or intelligence. The memorandum says these operations are carried out with the intent to remain undetected and may involve accessing systems without authorization from the owner or operator.
The second is called a Cyber Effects Operation. Those operations can manipulate or disrupt information systems. They can also deny access, degrade systems or destroy information and infrastructure controlled through those systems. However, this does not give private companies permission to start hacking suspected criminals on their own.
Companies participating in the program must be accepted by the government and enter into contractual agreements with either the Department of Justice or Department of Homeland Security. Operations conducted through the program must happen on behalf of the federal government and under its supervision.
The program’s DOJ and DHS executive directors must review cyber operations packages and provide written approval and direction before a participating company can act. Companies will also face vetting requirements. Those standards can examine technical proficiency, past cyber operations, facility security, personnel vetting and reliability. The rules must allow both large companies and smaller companies that may be better suited for specialized operations to participate.
DOJ or DHS may also require a participating company to maintain a bond or escrow account of at least $1 million. The money could be forfeited if the company violates its contractual agreement. The memorandum does not identify any companies that will participate.
GLOBAL PARTNERS ARE JOINING THE TRUMP ADMINISTRATION AND THIS FBI TO TAKE DOWN SCAM EMPIRES FOR GOOD
The program isn’t written to target anyone suspected of committing a cybercrime. The memorandum defines the targets as Cyber-Enabled Transnational Criminal Organizations, or CE-TCOs. These are foreign groups that conduct cyber-enabled crimes against the U.S. government, Americans or U.S. interests.
The definition excludes organizations that are an institutional part of a foreign government or wholly operated under a foreign government’s direction. That boundary is important because the operations being authorized can be highly intrusive.
The memorandum includes safeguards for operations that accidentally move outside their approved boundaries. If a participating company discovers that an operation has unintentionally targeted a U.S. person, a system located in the United States or a system controlled by a U.S. person, it must stop the operation. The company must also carry out required minimization procedures and immediately notify the National Coordination Center, which must notify the Justice Department.
Operations involving a U.S. person or other constitutional, federal law or international law concerns must also go through a Justice Department review and receive any required authorization before approval. There is another major restriction involving what the memorandum calls a Critical Outcome. An operation reaches that threshold if it is likely to result in loss of life or serious injury, or rise to the level of a use of force or armed attack under international law. The DOJ and DHS officials running the program are not allowed to approve operations that would produce those Critical Outcomes. The public memorandum does not spell out what would happen beyond that point.
The memorandum creates the framework for the program, but many of its operating procedures still need to be established. Program leaders have 60 days from Aug. 12 to develop rules governing how it will operate. Those procedures must address company eligibility, targeting, legal review, reporting and federal oversight. Participating companies must also be evaluated for continued participation at least once every year.
Within 180 days, program leaders must produce a status report for the White House homeland security adviser and the National Cyber Director. Additional reports are required annually after that. So, the overall framework is now in place. The detailed rules governing how these operations will actually work are still being developed.
You do not need to sign up for anything or change a setting because of this new policy. The potential impact is happening much farther behind the scenes. The program would give the federal government another way to pursue certain foreign cybercriminal organizations. Approved operations could gather intelligence or disrupt systems and infrastructure controlled by those groups.
At the same time, participating private companies would be carrying out powerful cyber operations under federal direction. How those operations are controlled will depend heavily on the procedures now being written. For you, your own cybersecurity habits remain as important as ever. If you suspect someone has already gotten into one of your devices, here are the steps I recommend taking if your computer has been hacked.
I’ve spent years showing you how to defend yourself when cybercriminals come after your money, identity or devices. What catches my attention here is the government’s attempt to put more pressure on some of the foreign criminal organizations carrying out these attacks. If federal officials approve operations that disrupt criminal infrastructure or produce useful intelligence, those efforts could add another layer to the defensive steps Americans already take. There are also plenty of reasons to watch how this develops. Secretly accessing or disrupting somebody else’s computer systems can have serious consequences if an operation reaches the wrong target. The memorandum requires federal approval, legal review and operational safeguards. Now I want to see what the final rules look like and how closely federal officials supervise participating companies once operations begin.
Would you feel safer knowing vetted U.S. companies could help the government disrupt foreign cybercriminals, or does giving private companies this kind of role make you uneasy? Let us know by writing to us at Cyberguy.com
Sign up for my FREE CyberGuy Report
Copyright 2026 CyberGuy.com. All rights reserved.
