Governments have long understood that the architecture of law tends to lag behind the architecture of threat. In the domain of transnational cybercrime — where criminal organisations operating across borders can drain financial accounts, encrypt hospital records, and extort individuals from jurisdictions beyond easy reach — that gap has been particularly acute. The Trump administration has, over the course of five months in 2026, moved to close it through a succession of executive instruments that culminate, for now, in the formal authorisation of offensive cyber operations against foreign-based criminal groups.
The sequence began on 6 March 2026, when President Trump signed Executive Order 14390, titled 'Combating Cybercrime, Fraud, and Predatory Schemes Against American Citizens.' The order directed the Secretaries of State, Treasury, and Homeland Security, together with the Attorney General, to complete a framework review within 60 days — by 5 May 2026 — and to submit a presidential action plan within 120 days, by 4 July 2026. That plan was to identify responsible transnational criminal organisations (TCOs) and propose means to prevent, disrupt, investigate, and dismantle them.
The order also mandated the creation of an operational cell within the National Coordination Center (NCC) to coordinate federal efforts against cyber-enabled criminal activity by foreign TCOs, with provision for private-sector involvement where appropriate. The order further directed the Secretary of State to demand that foreign governments take enforcement action against TCOs operating within their borders. Consequences for non-compliance specified in the order include sanctions, visa restrictions, limits on foreign assistance, trade penalties, and the expulsion of complicit foreign officials.
Separately, the Attorney General was given 90 days to submit a recommendation on establishing a Victims Restoration Program. The intention, as Skadden noted in its analysis, was to return clawed-back, forfeited, or seized funds directly to victims of cyber-enabled fraud. Whether that recommendation was submitted within the allotted window, and what it contained, is not yet publicly known.
On the same day as the executive order, the White House released its National Cyber Strategy. Latham & Watkins identified six pillars in the document: deterring cyber adversaries, improving cybersecurity regulation, modernising federal networks, strengthening critical infrastructure, expanding the cyber workforce, and securing emerging technologies including cryptocurrency, blockchain, and artificial intelligence.
A further executive order followed on 2 June 2026. Titled 'Promoting Advanced Artificial Intelligence Innovation and Security,' it directed agencies to strengthen federal cybersecurity, expand AI-enabled defensive tools, and prioritise enforcement against AI-enabled cybercrime, according to Mayer Brown's analysis.
The most consequential step came on 12 August 2026, when the president signed a National Security Presidential Memorandum (NSPM). The White House stated that the memorandum directed the NCC to create a programme for conducting offensive cyber operations against foreign-based TCOs, co-led by Executive Directors from the Department of Justice (DOJ) and the Department of Homeland Security (DHS). The framework explicitly permits private-sector companies to enter agreements with other private entities and with federal, state, local, tribal, and territorial agencies to gather threat information and propose cyber operations — all carried out under US government direction, control, and authority.
The same White House fact sheet states that the memorandum directs the programme's Executive Directors and the Homeland Security Council to establish review procedures ensuring compliance with the US Constitution, applicable laws, and international agreements. US News reported on the signing of the memorandum on 12 August 2026.
Significant questions remain unanswered. The specific TCOs named or targeted under any resulting action plan have not been made public. The scope and results of any offensive operations conducted under the NSPM are unknown. How voluntary private-sector agreements will be structured, overseen, and held accountable has yet to be detailed. Whether Congress has assessed or weighed in on the legal authority underlying the memorandum's offensive cyber authorisation is also unclear — a matter of some constitutional moment, given the breadth of the powers now formally on paper.
Comments (0)