Trump memo lets vetted private firms run cyber surveillance for DOJ and DHS

What happened

On August 12, 2026, Trump signed a national security presidential memorandum directing the National Coordination Center to build a program under which vetted U.S. companies conduct Cyber Surveillance Operations and Cyber Effects Operations against foreign cyber-enabled criminal organizations. The memo is titled “Expanding Capabilities to Combat Transnational Cyber-Enabled Crime.”

Each operation needs written approval from co-executive directors from the Justice and Homeland Security departments. Companies must contract with DOJ or DHS, post a bond of at least $1 million and be re-vetted annually. Companies must also contract with DOJ or DHS. The approval requirement and the bond are the memo’s stated limits on the program.

The memo defines surveillance operations as accessing systems without authorization while remaining undetected. Implementing procedures were due within 60 days, by October 11, with a status report at 180 days. The first deadline fell on October 11, and the memo’s 180-day status report is the next check the memo requires of the program.

Who benefited

DOJ and DHS gain contractors who can run operations defined as accessing systems without authorization while remaining undetected. Vetted private companies gain contracts, in exchange for a bond of at least $1 million. Vetted private companies gain contracts, and must post a bond of at least $1 million and be re-vetted annually to keep them.

Who wanted something

The White House wanted private capacity against transnational cyber-enabled crime, approved in writing by co-executive directors from the Justice and Homeland Security departments. The memo directs the National Coordination Center to build it. The memo is titled ‘Expanding Capabilities to Combat Transnational Cyber-Enabled Crime,’ and it names foreign criminal organizations as the targets.

Who lost out

The stated targets are foreign cyber-enabled criminal organizations, and the memo’s approval rests with co-executive directors from the two departments. Systems accessed without authorization belong to whoever owns them, and the memo defines the operations by their secrecy.

Why it matters

The memo gives vetted private firms a government-approved way to access systems without authorization, on a $1 million bond and two officials’ written approval. Implementing procedures were due October 11, and the first status report is due at 180 days.

Sources White House (primary)White House (primary)LawfareBaker McKenzie