Presidential Memorandum Creates New Opportunities – and New Risks – for Businesses that Partner with the Federal Government to Mitigate Cyberthreats

Until recently, businesses that partnered with the federal government to help mitigate cyberthreats were engaged in a purely defensive endeavour: co-operating with the government to share information and to develop and implement defensive strategies. On August 12, 2026, the White House issued a National Security Presidential Memorandum outlining an unprecedented new programme (the “Program”) that would allow private businesses to engage in offensive cyber operations – including conducting covert information-gathering and launching attacks on data, software, and IT systems – on behalf of the federal government and subject to its oversight and control. This article discusses the potential risks and opportunities of participation in the Program, contrasts these with the risks attending cooperation for purely defensive purposes, and highlights considerations for companies considering participation.

Traditional pathways for partnering with the government to mitigate cyberthreats

The two principal pathways were the Cybersecurity Information Sharing Act of 2015 (“CISA 2015”) and through ad hoc partnerships with regulators.

CISA 2015

For more than a decade, CISA 2015 has served as the principal pathway for the sharing of up-to-the-minute information about cybersecurity threats and protective measures between the federal government and the private sector. At its core, CISA 2015 establishes a framework for the voluntary sharing of “cyber threat indicators” and “defensive measures” between and among private entities and government agencies. CISA 2015 defines the term “cyber threat indicators” broadly to include, among other things, “information that is necessary to describe or identify” any cybersecurity threat or cybersecurity vulnerability. These include the methods employed by malicious actors to exploit a particular vulnerability and the actual or potential harm resulting from a particular type of cyberattack. Examples of cyber threat indicators include IP addresses from which malicious traffic is believed to have originated, known vulnerabilities in particular software programs and applications, and information about the types of digital assets that a given piece of malware is known to target.

Defensive measures are methods and devices for mitigating cyberthreat indicators, including detection and monitoring software of various kinds. Notably, CISA 2015 expressly excludes offensive tactics – such as accessing, harming, or destroying information or a computer system not owned by the actor – from the definition of “defensive measures.”

Participation in the information-sharing regime of CISA 2015 is entirely voluntary. The Act creates no duty to share information and no duty to warn or to act on the basis of information received. To encourage private entities to share information about cyberthreat indicators and defensive measures with the government, CISA 2015 includes a number of protections against liability and other legal safeguards for participating private entities. While a business’s monitoring of its own computer systems and networks might otherwise give rise to liability under the Electronic Communications Privacy Act of 1986 (“ECPA”), CISA 2015 authorises private entities, notwithstanding any other provision of law, to “monitor” and “operate defensive measures” on its own information system for cybersecurity purposes. And to the extent a business’s sharing of cyberthreat indicators could run afoul of state or federal privacy laws, CISA 2015 contains a broad exemption from liability when such data is shared in accordance with the Act.

To further incentivise private entities to share cybersecurity data with the government, the Act provides that such sharing does not waive privilege or trade secret protection in the shared information. Information shared pursuant to CISA 2015 is also shielded from disclosure under the federal Freedom of Information Act, 5 U.S.C. § 552, and state freedom of information laws. Moreover, CISA 2015 limits what the government can do with cybersecurity data shared pursuant to the Act. Subject to a few limited exceptions, information shared with the federal government pursuant to CISA 2015 may be used only for a “cybersecurity purpose” and cannot be used to regulate, or in support of an enforcement action against, the sharing entity.

To protect the privacy rights of individuals, the Act requires private entities to scrub personally identifiable information not directly related to a cybersecurity threat from any cyberthreat indicator data prior to sharing that data.

At present, CISA 2015 faces an uncertain future. The statute took effect on December 18, 2015 and briefly lapsed on September 30, 2025. On November 12, 2025, the Act was extended – with retroactive effect – to provide for continuous coverage through January 30, 2026. It has since been subject to several brief extensions and is currently set to expire on December 11, 2026.

Defensive sharing of cybersecurity information with the federal government outside the CISA 2015 framework

CISA 2015 does not limit or displace other avenues of voluntarily or legally compelled information sharing with law enforcement or federal regulators.

When a private entity engages in information sharing with the Department of Justice (“DOJ”) or other federal regulators, the protections of CISA 2015 do not apply. Such information sharing may result in a waiver of privilege or work-product protection under applicable federal or state common law and the information may be subject to disclosure under FOIA and analogous state statutes. Moreover, the limitations on liability applicable to information shared under CISA 2015 have no application when information is shared with the government via any other pathway and thus do not apply to ad hoc arrangements with regulators. Entities engaging in information sharing with the federal government outside of CISA 2015 receive only those limitations on liability for which they negotiate.

The new regime: a role for private businesses in offensive cyberoperations

In a series of recent executive orders and memoranda, the White House has announced a new pathway for private businesses to engage in offensive cyberoperations in partnership with, and subject to the supervision of, the federal government. This new pathway presents substantial risks and new opportunities for participating companies.

The 2026 Cyber Strategy presages a broader role for the private sector in combatting cyberthreats

On 6 March 2026, the White House released “President Trump’s Cyber Strategy for America,” a high-level blueprint of the Trump administration’s cybersecurity priorities. In a sharp break with prior statements of US cyberpolicy, the 2026 Cyber Strategy appeared to envision an offensive role for the private sector in combatting cyber-attacks and malicious actors online, stating: “we will unleash the private sector by creating incentives to identify and disrupt adversary networks and scale our national capabilities.”

EO 14390 calls for greater private sector engagement in investigating and disrupting cyberthreats

Also on March 6, 2026, the President signed Executive Order 14390, entitled “Combatting Cybercrime, Fraud, and Predatory Schemes Against American Citizens” (“EO 14390”) aimed at combatting cyberthreats of various kinds, including “ransomware and malware, phishing, financial fraud, sextortion and other extortion schemes” carried out by Transnational Criminal Organisations (“TCOs”). EO 14390 calls for the creation of a new “operational cell” within the Homeland Security Task Force National Coordination Center (the “NCC”). Like the 2026 Cyber Strategy, EO 14390 appeared to envision an offensive role for private industry in carrying out offensive operations against cyberthreats. The executive order instructs that the NCC operational cell “will be responsible for co-ordinating Federal efforts to detect, disrupt, dismantle, and deter – including by involving the private sector as appropriate – cyber-enabled criminal activity conducted by foreign TCOs and associated networks that target United States persons, businesses, critical infrastructure or public services.”

Read together, the 2026 Cyber Strategy and EO 14390 signalled the possibility of a new era in US cyberpolicy in which the private sector would be given some degree of license to “hack back” – that is, to counterattack or retaliate against foreign hackers.

The National Security Presidential Memorandum proposes an unprecedented role for the private sector in conducting offensive cyber-attacks and surveillance

On August 12, 2026, the President issued a National Security Presidential Memorandum (the “Memorandum”) directing the creation of the Program, which will authorise approved American companies to conduct offensive cyberoperations against “Cyber-Enabled Transnational Criminal Organizations” (“CE-TCOs”). The Memorandum contemplates that participants (“Participating Companies”) will conduct two types of offensive cyberoperations under the Program:

• “Cyber Surveillance Operations”: covert intelligence-gathering and surveillance activities conducted on computers, networks, and other information systems “with the intent to remain undetected”; and
• “Cyber Effects Operations”: the manipulation, disruption, denial, degradation, or destruction of systems, infrastructure, or information.

Deputising private businesses to engage in offensive cyberoperations on behalf of the federal government represents a sharp break with national cybersecurity policy under both Democratic and Republican presidential administrations – including the first Trump administration. But the Program outlined in the Memorandum is not a blank check for private businesses to “hack back” against malign cyber-actors. Participating companies must qualify for admission to the Program and once admitted, may act only within the scope of the federal government’s written authorisation and subject to its control.

The Program outlined in the Memorandum presents a novel set of risks and opportunities for private businesses that partner with the government to conduct offensive cyberoperations on its behalf.

The contours of the Program, as outlined in the memorandum

The Memorandum directs the NCC to “create, manage and maintain” the Program, which will be overseen by co-Executive Directors from DOJ and the Department of Homeland Security (“DHS” and together with DOJ, the “Program Executive Directors”). The Program Executive Directors are delegated authority to approve cyber operations under the Program but may not approve operations likely to result in death or serious injury or that constitute the use of force or an armed attack under international law. Participating Companies may act only with the prior written approval, and within the scope of the authorisation, of the Program Executive Directors, who are required to review every “cyberoperations package” before authorising an operation. The Memorandum requires the Program Executive Directors to promulgate “minimum standards that Participating Companies must meet in order to take part in the Program,” including “appropriate levels” of technical proficiency, competence and reliability. Participating Companies must contract with DHS or DOJ and may be required to post a bond of at least USD1 million, to be forfeited in the event of any non-compliance with the contract.

The Memorandum further instructs the Program Executive Directors, in co-ordination with the Homeland Security Counsel, to “establish consensus operating procedures for the Program that ensure the Federal Government’s complete oversight and control of Participating Companies’ performance.” The Memorandum directs that all Program activities are to be conducted “in accordance with the Constitution and all other applicable laws and international obligations of the United States,” including the Computer Fraud and Abuse Act, 18 U.S.C. § 1030 (CFAA), which is specifically identified in the Memorandum. The Memorandum further instructs that the forthcoming operating procedures require DOJ to review all Program activity in advance to ensure that any activity that is “directed at a United States person” or that otherwise implicates the government’s obligations under law “receives any necessary authorisation, judicial or otherwise, prior to approval of the operation.”

Finally, the Memorandum includes specific notice and data minimisation requirements for Participating Companies. If a Participating Company discovers Program activity outside the approved scope of the operation – such as targeting a United States person or an information system located on US soil – it must cease the operation, conduct minimisation procedures and notify the government. Participating Companies likewise must notify the government if they discover an imminent attack against United States critical infrastructure or develop a reasonable belief that an approved attack may result in death or serious injury, or may constitute a use of force or armed attack under international law.

New opportunities for partnering with the government to combat cyberthreats

The precise contours of the Program and the allocation of risks and responsibilities between the federal government and Participating Companies have yet to be defined. But, in broad strokes, the Memorandum points to a new set of opportunities beyond those offered by CISA 2015 for businesses to obtain government assistance in combating specific cyberthreats.

Under the information-sharing regime of CISA 2015, the role of private businesses is purely defensive: businesses share de-identified information about cyberthreat indicators and propose and implement defensive countermeasures. Offensive cyber-operations against threat actors are left to the government. Under the Program, however, Participating Companies will themselves conduct offensive operations on behalf of the government and subject to its control. The Program thus creates a new species of government contract and a new market opportunity for cybersecurity firms and other businesses that choose to become Participating Companies.

More broadly, the Program appears to open a new pathway for private businesses affected by cyber-attacks to lobby the NCC, through a participating company, to authorise offensive countermeasures on their behalf. Indeed, the Program may afford savvy businesses the opportunity to propose specific countermeasures against specific cyber-actors to be carried out by the specific Participating Company of their choice. The Memorandum authorises Participating Companies to enter into “commercial agreements” with private businesses – as well as state, local, and tribal governmental entities – to receive information about specific cyberthreats for the purpose of proposing responsive cyber-operations to the NCC. By and through the Participating Company, a business could propose a specific counterattack and, upon approval by the Program Executive Directors, the Participating Company could carry it out. The wording of the Memorandum suggests that the White House intends for the Participating Companies – rather than their clients – to develop the proposed countermeasures. But businesses affected by cyber-attacks may demand a role in crafting the proposed countermeasures to align with their interests and risk tolerance – particularly in cases involving stolen intellectual property, where a ransom has been paid, or where there is concern about reprisals. At a bare minimum, businesses affected by cyber-attacks should negotiate for a role in shaping any proposed cyber-operations when contracting with Participating Companies.

In the alternative, large, sophisticated businesses might elect to “cut out the middleman” and obtain Participating Company status for themselves by cultivating cybercapacity in-house or through mergers and acquisitions activity.

Participation in the Program may entail unprecedented risks

At the same time, the Program described in the Memorandum suggests a far broader set of risks and responsibilities than those attending information sharing pursuant to CISA 2015—including risks previously borne by the government alone. Businesses considering participating in the Program should begin assessing these risks and opportunities now while awaiting further guidance from the White House and the Program Executive Directors.

Potential exposure under CFAA and other federal statutes

The operations contemplated by the Program may expose Participating Companies to liability under a range of federal and state statutes, including the CFAA. On its face, the CFAA prohibits private entities from engaging in the very activities outlined by the Memorandum: unauthorised access and surveillance of a private computer network or causing damage to such a network or to any data stored thereon. The CFAA provides for criminal and civil liability and provides for a private right of action. But the CFAA carves out lawful investigative, protective, or intelligence activity conducted by the government, and the Memorandum proceeds from the assumption that Program operations will be covered by this liability exception, stating: “[t]he NCC shall conduct all Program activities in accordance with the Constitution and all other applicable laws and international obligations of the United States” – including the CFAA – “thereby ensuring that Participating Companies are acting under the control and oversight of the United States Government.”

Companies considering participation in the Program should not take this assurance at face value, however, and should not assume that any immunity or defence to liability available to the government will necessarily be available to them. The government’s sovereign immunity from suit “is not transferrable to agents, including contractors, of a government.” Hence, “[a] private contractor cannot obtain immunity from suit by reason of a contract it made with the government.” And while government personnel acting under government control and oversight generally may invoke qualified immunity from suit, the Supreme Court “has not decided whether corporate contractor defendants” may do so.

Alternatively, Participating Companies acting within the scope of the Program might avail themselves of the Yearsley doctrine. Under Yearsley, “a federal contractor cannot be held liable for conduct that the government has lawfully authorised and directed the contractor to perform”; “liability may attach only if the authorisation was unlawful or if the contractor acted outside its scope.” But the propriety of the delegation of government authority contemplated in the Memorandum remains an open question. Executive orders and presidential memoranda like the Memorandum cannot supersede a statute such as the CFAA, which on its face appears to prohibit private businesses from engaging in the very operations outlined in the Memorandum. Even if available, a Yearsley defence is a defence to liability and thus requires an adjudication on the merits – it is not a blanket immunity from suit. Consequently, even a successful invocation of a Yearsley defence could require years of litigation, with all of its associated costs and distractions.

Even if the activity of Participating Companies falls within the CFAA safe harbour for government “investigative, protective or intelligence activity,” Program activity still might run afoul of other federal and state statutes, including ECPA and state wiretap and stored communications laws modelled thereon, the Foreign Intelligence Surveillance Act, and state-law analogues of the CFAA such as the California Comprehensive Computer Data Access and Fraud Act. Participating Companies also should be sure to evaluate the legality of a proposed operation under the law of any foreign jurisdiction where the actor, data, or infrastructure targeted by the operation are located.

Don’t expect the protections afforded by CISA 2015

As noted above, CISA 2015 provides for immunity from liability under state and federal wiretapping and data privacy laws, exemption from state and federal FOIA disclosure, and protection of privilege in information shared with the government. The Program, in contrast, does not provide for any such provisions. And because the Program was created by executive order rather than an act of Congress, the legal effect of any purported immunity would be doubtful in any event.

Conversely, the Program entails a new set of affirmative notice obligations unlike anything in CISA 2015 and may impose difficult judgment calls on Participating Companies. For instance, as noted above, the Memorandum requires Participating Companies to “immediately notify” the NCC if they “develop a reasonable belief that an approved” operation may result in death or serious injury or may constitute a use of force or armed attack under international law. If an approved operation yields sufficiently serious unforeseen consequences, a Participating Company may find itself defending an alleged notice failure under an amorphous “reasonable belief” test. At a minimum, Participating Companies should keep careful records of any potential concerns identified during the course of an operation, including when and how such concerns were addressed and the timing and substance of any discussions of such concerns with the NCC. 

Misattribution risk can increase cost and lead to liability to third parties

Finally, businesses considering participation in the Program should think through the associated practical risks. Chief among these is the danger of misattribution. Cyber-actors often engage in digital misdirection to make it appear that their attacks are emanating from other actors (and to cover their tracks). Participating Companies should plan for the possibility that an attribution error will result in collateral damage to the information, applications, or infrastructure of innocent third parties.

Participating Companies should also be aware of the risk that Program operations may inadvertently target proxies of foreign governments. The Memorandum defines a CE-TCO as “any foreign group that conducts cyber-enabled crime against the United States Government, a United States person or United States interests, and that is not an institutional part of a foreign government or wholly operated under a foreign government’s direction.” Notably, while the EO acknowledges that foreign regimes often “provide willing or tacit state support to cybercrime and predatory schemes,” the Program presumes that its targets are notan institutional part of or wholly operated by a foreign government “unless clear intelligence exists establishing such connection.” As a practical matter, clear evidence of such a tie may not emerge until an operation is underway, if at all.

Participating Companies should negotiate for clear allocation of risks and responsibilities in Program contracts

As discussed above, Participation in the Program may expose participating companies to risks previously borne by the government alone. Companies partnering with federal regulators for defensive cyber-operations and information sharing in other contexts commonly negotiate the parameters of their engagement. Given the novelty of the Program, the unprecedented risk profile, and the potential exposure, companies considering participation in the Program should negotiate for the allocation of risks in Program contracts, as well. Among other things, participating companies may wish to provide for advancement and indemnification, confidentiality, clear delineation of roles and responsibilities as between the government and the participating company, and for clarity around the conditions that trigger forfeiture of the bond.

Conclusion

The Program creates an unprecedent set of opportunities and risks for private businesses that partner with the federal government in cyberspace. Businesses considering participation in the Program should evaluate such risks and opportunities with care and should await further clarification from the White House regarding the specifics of the Program.