President Donald Trump has signed a new national security presidential memorandum that allows private companies to conduct cyberattacks on "transnational criminal organizations" on behalf of the federal government. The Trump administration says the decision will leverage "the capability and innovation of the private sector" to respond to ransomware attacks, sextortion, financial fraud and phishing.

Traditionally, the Computer Fraud and Abuse Act (CFAA) has applied to private companies and individuals. In 2022, the Department of Justice announced it would no longer prosecute white-hat hackers for security research, but this memorandum vastly expands the kinds of cyber activity the DOJ could decline to prosecute. The details remain undefined; the memorandum directs the Homeland Security Task Force to develop standards within 60 days.

Participating companies must pay a $1 million bond that will be forfeited if they don't comply with the government's direction. While offering protection from US prosecution, the memorandum doesn't explain what will happen if companies or employees are criminally charged in foreign countries. The memorandum was signed after a wave of cyberattacks on water facilities linked to Iran.