The U.S. is bringing the private sector into offensive cyber operations: a new era in the fight against digital crime.
The U.S. administration has made a radical move that could upend the perception of interaction between the state and the private sector in cyberspace. On August 12, President Donald Trump signed a memorandum opening access for certified commercial companies to offensive cyber operations against foreign criminal syndicates. This is not just an expansion of authority—it is the creation of a new paradigm where business becomes an operator of state cyber power.
The program targets transnational groups engaged in ransomware, financial fraud, and other illicit activities in the digital environment. Contractors will gain the right not only to gather intelligence on their infrastructure but also to conduct disruptive strikes—from blocking and impairing systems to the complete destruction of equipment and data.
Control mechanics and participant requirements
Operational leadership is assigned to the National Coordination Center under the Department of Homeland Security, with oversight provided by the Department of Justice. The key principle is that companies act exclusively "under the direction, control, and authority of the U.S. government." Independent selection of targets is strictly prohibited.
For admission to the program, contractors must undergo rigorous certification: confirm technical competence, experience in similar operations, and the security of their own infrastructure. Financial security—a bond or escrow account of at least $1 million—may be confiscated in case of violations of the terms.
It is important to note the restrictions: attacks are permitted only against foreign criminal structures that are not part of another state's government and are not under its direct control. This eliminates the risk of diplomatic incidents with state-backed hacker groups.
From intelligence to action: evolution of the approach
Preparation for this step has been underway since spring. In a decree dated March 6, Trump ordered the development of a plan to counter foreign scam centers, providing for the creation of an operational cell and the involvement of the private sector. At the same time, the Department of Justice and DHS were tasked with leveraging the technical expertise and intelligence data of commercial cybersecurity companies.
The new memorandum shifts this directive from the intelligence domain to the operational one. Previously, cooperation with tech giants—Apple, Coinbase, Google, Meta, Microsoft, SpaceX, TRM Labs—was limited to the scope of their own platforms. In May, as part of Operation Scam Center Strike Force, companies blocked over 1.4 million accounts, froze more than $3.8 million in cryptocurrency, and helped detain seven suspects in Thailand. Now, business will gain the right to direct disruptive action.
My analysis: this is an unprecedented step that carries both significant opportunities and serious risks. On one hand, engaging the private sector with its resources and technologies could significantly enhance the fight against transnational cybercrime, whose damage in the Asia-Pacific region alone reaches $114.1 billion per year. On the other hand, the question of responsibility and accountability arises. Who will answer for collateral damage or conflict escalation if a private company's actions lead to unforeseen consequences? The answers to these questions will determine whether this program becomes a model for other countries or a cautionary tale.