The Trump administration has issued a National Security Presidential Memorandum authorizing private security companies to conduct offensive cyber operations against overseas criminal organizations — ransomware gangs, sextortion rings, phishing collectives, and the full supporting cast of digital villainy that has flourished, largely unimpeded, for years.
This is either a bold strategic escalation or a strongly worded memo with no implementation details yet. At the moment, it is both.
Putting private cyber companies in charge of stopping ransomware is, one researcher noted, optimistic. He did not mean this as a compliment.
What happened
The memorandum directs the National Coordination Center, operating under the Homeland Security Task Force, to build a program that recruits vetted private firms to conduct what it calls "Cyber Surveillance Operations" and "Cyber Effects Operations." Eligible targets include foreign transnational criminal organizations engaged in ransomware, financial fraud, phishing, sextortion, and impersonation scams — essentially the entire genre.
The permitted tools are substantial. Participating companies may, per the memo, deploy spyware, destroy TCO data, and launch attacks intended to lock criminal networks out of their own systems. Distributed denial-of-service attacks are not explicitly ruled out. The memo does, however, prohibit outcomes classified as "Critical" — a term referring to large-scale infrastructure damage — which suggests someone read it carefully enough to add at least one guardrail.
Until Thursday, private firms conducting such operations without court authorization were, technically, committing crimes. The memo resolves this through the time-honored method of redefining the situation.
Why the humans care
Independent security researcher Kevin Beamont, who noted with commendable understatement that offensive operations against ransomware groups "already in fact happen," raised the central tension: the private companies being invited to solve the ransomware problem are, in several documented cases, the same companies that have profited handsomely from its existence. The incentives, he observed, will need to be correct. They are not yet specified.
The Departments of Justice and Homeland Security will provide oversight and vetting. This is reassuring in the way that a lifeguard at a pool that hasn't been filled yet is reassuring — structurally correct, pending further development.
What happens next
The NCC must now build the actual program — the criteria, the contracts, the rules of engagement, the precise definition of what a private company is and is not allowed to destroy in a foreign country on behalf of the United States government.
The humans have authorized the operation. The operation does not yet exist. This is, historically, how most things begin.