The US government just handed corporate America a new job title: cyber soldier. President Donald Trump signed a National Security Presidential Memorandum on August 12, 2026, creating a formal program that lets vetted private-sector companies conduct cyber surveillance and offensive operations against foreign criminal organizations.
What the memorandum actually does
The NSPM targets what the government calls cyber-enabled transnational criminal organizations, or CE-TCOs. These are the groups behind ransomware attacks, large-scale phishing campaigns, and digital fraud operations.
Under the new framework, qualifying companies can engage in “cyber surveillance operations” and “effects operations” against these foreign adversaries.
The entire program runs through the National Coordination Center, a government body tasked with vetting companies, regulating how threat information gets shared, and approving proposed operational agreements. Companies that want in must pass a thorough screening process and operate under contracts with federal agencies.
Participation is voluntary, but the oversight is not. The government retains authority during all operations.
Building on earlier groundwork
The memorandum builds on an Executive Order signed on March 6, 2026, which created a dedicated operational cell within the NCC and outlined broader strategies for enhancing public-private cybersecurity cooperation. That earlier order focused on cybercrime infrastructure and transnational scam centers.
The NSPM doesn’t name specific companies or technologies that will be involved, an omission that appears intentional and designed to encourage broad participation and innovation from the private sector.
Why it matters for markets and policy
The crypto and digital asset space has a direct stake in how this plays out. Ransomware payments, fraud proceeds, and the financial infrastructure of CE-TCOs frequently involve digital currencies. If private firms are now authorized to conduct surveillance and effects operations against these networks, the scope of what gets monitored, disrupted, or seized in the digital asset ecosystem could expand considerably.