White House Memo Lets Vetted Security Firms Run Offensive Cyber Operations Against Foreign Crime Groups
The August 12, 2026 memorandum places every approved operation within a Justice Department and Homeland Security Department framework.
Local business owners should determine how the program may apply to their organizations’ systems and services.
What happened
According to BleepingComputer, a national security presidential memorandum signed on August 12, 2026 directs the National Coordination Center to establish a program for vetted U.S. private security companies to conduct cyber surveillance and cyber effects operations against foreign cyber-enabled transnational criminal organizations. Operations must occur under federal direction and supervision.
The White House memorandum assigns oversight to two Executive Directors, one designated by the Attorney General and another by the Secretary of Homeland Security. Participating firms must enter contracts with the Department of Justice or the Department of Homeland Security and pass a rigorous vetting process.
Are you affected?
The program directly affects private security companies that volunteer for federal contracts. No Google Business Profile, website platform, browser or operating system is named in the memorandum, and the source does not state that local retailers, clinics or trades must enroll.
The source does not provide affected software versions, settings or a public checklist for businesses. The program is intended to disrupt foreign criminal organizations involved in ransomware attacks, phishing campaigns, financial fraud, sextortion schemes and impersonation scams.
The memorandum defines a “Critical Outcome” as an action likely to result in “the loss of life or serious injury” or to “rise to the level of use of force or armed attack under international law.” The two Executive Directors cannot approve operations expected to generate that outcome.
What to do now
- Review access to business systems. Remove unused accounts, require multifactor authentication where available and confirm that email, payment, website and remote-access accounts have named owners.
- Prepare for phishing and impersonation attempts. Train staff to verify unusual payment requests, password-reset prompts and calls claiming to represent customers, suppliers, payment processors or government agencies.
- Protect the customer-facing website. Keep the site, hosting account, domain registration and content management system protected with unique credentials, multifactor authentication and prompt updates.
- Protect Google Business Profile access. Limit administrator accounts, use multifactor authentication and remove former staff members who no longer need access.
- Keep an incident response record. Document who can suspend accounts, reset systems, notify customers and contact payment providers or law enforcement after suspected compromise.
How the program would work
Participating companies may receive threat information gathered during the normal business activities of private organizations. They may also enter arrangements with federal, state, local, tribal and territorial agencies that identify threats involving foreign cyber-enabled criminal organizations.
That information can support a proposed operation submitted to the National Coordination Center. A company cannot authorize its own action. The Executive Directors must coordinate before approving an operation, and the resulting action must be conducted on behalf of and under the supervision of the federal government.
The memorandum defines a Cyber Effects Operation as activity that manipulates, disrupts, denies, degrades or destroys information systems, networks, physical or virtual infrastructure controlled by those systems, or information held in them.
What safeguards apply to private security firms
Participating companies must maintain a bond or escrow of at least $1 million. The memorandum states that the bond can be forfeited if the company fails to comply with its contractual agreements.
Each firm must stop an operation immediately if it discovers activity beyond the approved scope. That includes unintended targeting of U.S. citizens or U.S.-based systems. The company must also notify the National Coordination Center.
Program activity must comply with the Constitution, federal law and applicable international obligations. The Executive Directors and the Homeland Security Council are responsible for developing implementation procedures that govern review and conduct. A private company’s participation therefore depends on federal approval and continued oversight.
Why local businesses should care
The program targets organizations linked to ransomware attacks, phishing campaigns, financial fraud, sextortion and impersonation scams.
The White House fact sheet says U.S. consumers reported losing more than $20.8 billion to cyber-enabled crime in 2025. It also reports that 73% of U.S. adults had experienced an online scam or attack, while 98% believed scams threatened individuals in the United States. Two-thirds of respondents described the threat as major.
Industry reaction
Veracode co-founder Chris Wysopal called the memorandum a “pretty big shift in US cyber policy” and a “major expansion of the private sector’s role in offensive cyber operations,” according to BleepingComputer. Jason Kikta, former leader of the Cyber National Mission Force and CTO at Automox, described it as a “perpetual motion machine for billable threats.”
Private security firms may contribute technical capacity and operational speed, while legal authority remains with federal officials. The source does not specify the vetting timeline or the program’s start date.
Key details still pending
The memorandum leaves implementation guidance to the Executive Directors and the Homeland Security Council.
Local businesses should focus on strengthening access controls and scam-response procedures while federal officials develop the detailed rules.
FAQ
What does the White House offensive cyber operations memo do?
It directs the National Coordination Center to establish a program that allows vetted U.S. private security companies to conduct cyber surveillance and cyber effects operations against foreign cyber-enabled transnational criminal organizations under federal control and oversight.
Which local businesses are affected by the memo?
Participating private security companies are directly affected.
What bond must participating security firms maintain?
Participating companies must maintain a bond or escrow of at least $1 million. The memorandum says the bond can be forfeited if the company fails to comply with its contractual agreements.
BizScoreAI
BizScoreAI scores how visible a business is to AI search and shows what its listing looks like to the engines people ask. Open the free listing check.