Trump Memo Authorizes Vetted U.S. Firms for Cyber Effects Operations Against TCOs Within 60 Days

The memorandum explicitly permits two operation classes: unauthorized access for data collection and actions that disrupt, deny, degrade, or destroy target systems. Participating firms must operate under NCC direction, cease activity outside approved parameters, and report any U.S. person or domestic system contact immediately to the Department of Justice. The text carves out TCOs that show evidence of state direction while still allowing operations against groups with loose government ties. Procurement records and prior NCC pilot language indicate the program will route through existing CISA and DOJ contracting vehicles rather than new legislation, bypassing standard Title 18 restrictions on private hacking. This mirrors the structure used for the 2021-2023 ransomware disruption task forces but removes the requirement for court orders before effects actions. Germany's parallel draft law expanding BSI and BND server takedown authorities provides a direct comparator; both initiatives shift offensive capability to state-vetted private actors while retaining nominal government oversight. U.S. firms with existing government red-team contracts are the most probable early participants, creating a de facto offensive cyber reserve. Next steps include NCC publication of participation criteria and initial target lists. Expect rapid contract awards to firms already holding classified clearances, followed by legal challenges testing whether private entities can lawfully receive preemptive disruption authority without individualized warrants.