The White House has made a significant policy shift, authorizing federal law enforcement agencies to work in tandem with private firms to conduct offensive cyber operations against foreign threat actors targeting the United States. This move is part of a broader strategy to enhance the nation’s cybersecurity capabilities, as highlighted in a National Security Presidential Memorandum (NSPM) signed by President Donald Trump on August 12. This memorandum builds upon an Executive Order from March, which mandated government agencies to engage in rigorous actions to combat cyber-enabled crime that threatens American citizens.
The NSPM draws attention to the underutilization of the American private sector, which is often regarded as the most advanced and innovative in the world. The government has acknowledged that, historically, these capabilities have not been fully leveraged in efforts to identify and disrupt criminal networks operating in cyberspace. By facilitating the involvement of private sector entities, the government aims to create a stronger front against cybercrime.
To oversee this initiative, the National Coordination Center (NCC), which is part of the Homeland Security Task Force, is set to establish a comprehensive program. Leadership will be shared between two Executive Directors from the Department of Justice and the Department of Homeland Security, ensuring that operations remain aligned with government oversight.
Under the framework provided by the NSPM, private sector companies eager to participate can forge agreements with each other, as well as with federal, state, and local government bodies. This collaboration aims to enhance the gathering of threat intelligence on transnational cybercriminal organizations and design coordinated cyber operations intended to disrupt their activities. Notably, the memorandum emphasizes that any cyber operations will be conducted under the firm direction of the US government and within strict legal and constitutional boundaries, ensuring compliance with relevant international agreements as well.
The White House has underscored the urgency of deploying every possible tool against transnational cyber threats. With American consumers reportedly losing more than $20.8 billion to cyber-enabled crime in 2025 alone, the impact of online scams has been profound, affecting 73% of U.S. adults in some form. This statistic has fueled the sense of urgency surrounding the NSPM’s approval.
### Reactions from the Cybersecurity Community
The cybersecurity community’s response to this memorandum has been mixed. While several professionals have applauded the expansion of public-private collaboration in cyber operations, others have expressed concerns about the implications of this new approach. Chris Wysopal, co-founder of Veracode, remarked on X that the policy represents a remarkable shift in U.S. cyber policy. He viewed it as a substantial enhancement of the private sector’s role in offensive cyber operations, distancing it from the traditional concept of “hack back.”
Conversely, skepticism remains prevalent among some cybersecurity experts regarding the risks associated with offensive cyber strikes, particularly concerning the involvement of private entities. Concerns center around the potential for misidentifying targets and the resultant risk of escalating cyber hostilities rather than serving as a deterrent. Nick Carr, technical director for the Microsoft Threat Intelligence Center, elaborated on these concerns by highlighting the challenges involved in accurately attributing cybercrimes. Having led a global cybercrime and ransomware intelligence team for several years, Carr noted that even governmental agencies struggle with reliable attribution, which could lead to significant missteps and escalating tensions.
Dr. Lukasz Olejnik, an independent researcher specializing in cybersecurity and privacy, warned about the ramifications of granting licenses for offensive operations targeting cyber-controlled infrastructures. He cautioned that such actions could unintentionally impact state-linked infrastructures, raising concerns about the escalation of interstate cyber conflicts.
The United Kingdom has also been actively pursuing similar strategies, having established the National Cyber Force (NCF) in 2020 to conduct offensive cyber actions aimed at disrupting and deterring cybercriminal entities. In 2023, the UK government published principles regulating the use of such capabilities, emphasizing that these measures would be deployed only in circumstances where alternative responses are insufficient to address the challenges effectively.
As the global landscape of cybersecurity continues to evolve, the intersection of government action and private sector capabilities will increasingly shape the future of cyber defense. The implications of these strategies could define how nations navigate the complex terrain of cyber threats in the years to come.
In conclusion, the White House’s initiative marks a pivotal moment in the U.S. cybersecurity landscape, reflecting a profound shift in strategy that mobilizes both public and private sectors in combating transnational cyber threats. As enthusiasm meets concerns within the cybersecurity realm, the outcomes of this unprecedented collaboration will be closely monitored in the coming months.