Overview
The Trump administration’s announced program to coordinate private sector anti-cybercrime operations creates new opportunities for US offensive cyber statecraft. It represents a more aggressive approach to US cyber policy and could usher in a new industry of offensive cyber contractors, attracting both established technology companies and start-ups. However, the program could also expose participating companies to unforeseen liabilities and heightened cyberattack risks. If not carefully calibrated and monitored, offensive cyber operations targeting foreign criminal organizations could escalate cyber campaigns conducted by US adversaries in coordination with cybercriminals. These foreign cyber-attacks could affect companies participating in the coordination program and private sector bystanders, raising the general cyber risk environment for US companies. Non-US companies also risk being mis-targeted in private sector cyber operations if the coordination program fails to enforce stringent operational review and approval guidelines.
Precedent for Private Sector Cyber Disruption
The program is likely inspired in part by the success of prior ad hoc private sector cyber operations. In August 2025, Google announced the creation of a cyber “disruption unit” to proactively take down illicit cyber operations. The company stated at the time that it was attempting to find “legal and ethical” options for the new unit. In January 2026, Google announced that, with court approval, it successfully used cyber and legal tools to take down a proxy network used by hackers.
In 2020, a Virginia court authorized another major tech company to disrupt TrickBot, a cyberattack service provider that sold malicious actors access to a botnet for use in cyberattacks. The takedown was conducted in coordination with US Cyber Command, which used its capabilities to disconnect the botnet from the internet and effectively eliminate 94% of its servers.
Both precedents relied on individual companies petitioning federal courts to allow narrow cyber disruption operations. The US judicial system likely cannot approve effective cyber operations with the necessary speed and technical expertise. The White House’s proposed coordination program would maintain oversight over private sector cyber operations and create opportunities for cooperation with federal, state and local authorities. It would also potentially enable a more efficient pipeline for the private sector to pitch, get approval for and execute cyber operations than the ad hoc system of narrow court approvals.
Functioning of the Coordination Program
While the presidential memorandum announcing the cyber coordination program does not provide final details on how such a program would function, foundational guidelines exist. As a whole, they lay out a program emphasizing efficiency, open to a wide range of cyber contractors, and concerned with establishing and enforcing guardrails on participating companies.
According to the memorandum, participants will submit proposals for “Cyber Surveillance and Cyber Effects Operations” based on standardized rubrics and templates. Representatives from the Departments of Justice and Homeland Security would review the proposals for adherence to US law and policy priorities and deconfliction with other federal agencies.
The targets of proposed operations would be strictly limited to foreign Cyber-Enabled Transnational Criminal Organizations (CE-TCOs) not part of or “wholly operated by” a foreign government. The operations would also be limited in effect, with participants barred from operations that are likely to result in loss of life or injury or be considered a “use of force” under international law.
Participating companies would need to submit to a credentialing process and would be subject to oversight throughout the implementation of proposed operations. To help ensure good behavior by contractors, the memorandum requires a $1 million bond from participating companies that can be forfeited for program non-compliance.
Target Choice Risks Escalating Hybrid Warfare
The memorandum attempts to keep private cyber operations from targeting foreign government-affiliated cyber networks. However, the murky nature of links between state intelligence agencies and cybercriminal networks raises the likelihood that cyber operations overseen by the coordination program could target state-linked foreign groups. The memorandum states that a CE-TCO will only be considered government-controlled if there is “clear intelligence” establishing the connection.
Moscow, for example, is routinely accused of orchestrating cyberattacks in coordination with Russian, Belarussian and other local cybercriminals. The ambiguous links between Russian intelligence and these hacker groups facilitate Russia’s hybrid-warfare strategy, where Russia can conduct attacks on foreign infrastructure behind a haze of plausible deniability. Hybrid warfare explicitly avoids creating the “clear intelligence” of state affiliation referenced in the memorandum.
This lack of clarity raises new risks for the private sector: a private company that carries out a cyber operation against a state-linked criminal group could become the target of a state-backed “hack-back” campaign. Foreign governments could also view the coordination program as an escalatory measure by the US, potentially pushing adversaries to support more aggressive cyber disruption or other hybrid activities targeting US infrastructure and companies. Such an escalation would likely impose costs on private companies whether or not they participated in the cyber coordination program.
Additionally, in jurisdictions with pervasive corruption, criminal groups often have tacit support or protection from politicians and senior government officials. One of the obvious targets for the memorandum are the high-profile scam center networks operating in Southeast Asia. However, US authorities have officially accused several regional politicians of profiting from and providing cover for the scam centers. At what point would state capture by criminal actors cause transnational criminal groups to be considered state-controlled?
Risk of Expertise “Spillage”
The memorandum cites the sophistication, entrepreneurial spirit and innovativeness of the US tech sector in justifying a push for private sector cyber operations. However, these same factors risk creating new cyber threats as contractors are able to test and refine software and cyber capabilities by conducting operations against CE-TCOs. Participating companies will be effectively developing cyber weapons and deploying them in surveillance or in technologically disruptive “Effects” operations. Although private company participants are under US government supervision while in the program, it is unclear how the activities of the companies and their employees will be restricted once they leave the coordination program. The US already faces issues where former personnel from cyberwarfare or special operations programs are hired by foreign governments to consult on or run military and espionage operations, sometimes in violation of US law governing weapons export controls. Without proper safeguards, the US risks creating a new cohort of experienced and commercialized cyber operators, this time without existing restrictions imposed on former direct government employees. The US will likely have to balance between not allowing cyberwarfare expertise to proliferate to foreign competitors or illicit actors against imposing so many restrictions that participation will be effectively restricted to large established companies able to satisfy stringent government regulations.
Businesses Caught in the Cyber Crossfire
Companies participating in the cyber coordination program likely expect to receive liability waivers from current US law preventing unauthorized access to computer systems. Such a waiver, combined with the notorious difficulty of accurately targeting cyber disruption operations, could cause innocent non-US companies to suffer damages from a cyber operation without the ability to recoup losses through litigation. Malicious cyber actors frequently disguise their activities by launching cyberattacks through a third party’s infected cyber infrastructure. A company unwillingly weaponized in this way could face compounded disruptions by being mistargeted in a US anti-cybercrime disruption operation.
Aside from being targeted in a mistaken identify scenario, businesses could face unintended spillover effects from cyber operations targeting malware infrastructure. Both precedential private sector disruptions referenced above involved disabling proxy networks that piggybacked off internet-connected devices used by potentially innocent people. A similar operation attempting to disrupt botnet architecture could theoretically take the technology unknowingly hosting the malware offline, disrupting the company’s operations and potentially rendering its expensive cyber infrastructure inoperable.
US companies face fewer spillover risks, as the presidential memorandum places strict blocks on any operations targeting or affecting US persons. Still, US firms could face indirect risks from foreign criminal actors seeking to retaliate against the US for sponsoring aggressive cyber operations against illicit groups.
Outlook for Future Implementation
The memorandum tasks the DOJ and DHS with creating the basic operating procedures for the cyber coordination program by mid-October, with an initial status report due in February 2027 to White House homeland security and policy advisor Steven Miller and cyber advisor Sean Cairncross. Policymakers will likely take the next six months to craft the oversight apparatus required in the presidential memorandum, as well as the details of any liability protections for participating companies. The private sector will likely demand additional information on risk mitigation and financial benefits to contractors before agreeing to participate. The challenge for policymakers will be to ensure that empowering the private sector to fight cybercrime does not inadvertently create new threats that are harder to control. Given proven industry and policy support for anti-cybercrime campaigns, a cyber coordination program implemented during the Trump administration will likely survive in some form into future administrations if well implemented.
