President Trump has signed a memo authorising US government agencies to contract private cybersecurity firms to conduct offensive cyber operations — including surveillance and network disruption — against cyber-enabled transnational criminal organisations (CE-TCOs), excluding entities acting on behalf of foreign governments. Participating companies must undergo rigorous vetting, meet annual technical evaluations, maintain at least $1 million in bond or escrow, and are prohibited from operations that could cause loss of life or be considered an act of war. Legal experts have raised concerns about whether existing laws, particularly the Computer Fraud and Abuse Act, adequately cover private companies conducting such government-directed operations, though a key exemption may offer some protection.
