Around the world, broad intelligence and law enforcement frameworks for combating cyber-enabled crimes are on the rise, raising questions of how such national frameworks intersect with international law.
In the United States, President Donald Trump in March signed an executive order “unleashing” every tool at the U.S. government’s disposal to combat foreign criminal groups carrying out cyber-enabled crimes against Americans. While the executive order exclusively contemplated action by government authorities, that same month, Trump issued a cyber strategy document that promised to “unleash the private sector.” Building on this strategy, Trump signed a presidential memorandum in August bringing in the private sector to carry out surveillance and cyber operations against “transnational criminal organizations” (TCOs).
The August 2026 memorandum, entitled “Expanding Capabilities to Combat Transnational Cyber-Enabled Crime,” directs the National Coordination Center to establish a program under which vetted private sector companies will “conduct Cyber Surveillance Operations and Cyber Effects Operations against foreign Cyber-Enabled Transnational Criminal Organizations,” all “under the control and oversight of the Federal Government.” Other authors have covered the domestic legal issues raised by this memorandum, such as the precise scope of exceptions to U.S. anti-hacking statutes. But any program specifically designed to allow private actors to carry out operations against groups located in other States also raises international law questions.
This article is the first in a series examining the international law questions raised by various domestic frameworks, as well as their implications for constitutional orders, human rights, and even global cybersecurity. Here, I consider the U.S. example. In subsequent entries, Lori Roussey will cover efforts in France; Simone Ruf will focus on Germany; and Hinako Sugiyama will analyze structures in Japan.
War Powers Under a Law Enforcement Disguise?
The President is not the only one keen to tap into the private sector’s cyber capabilities. The Senate’s proposed amendment to the 2027 National Defense Authorization Act (NDAA) would establish a pilot program allowing private sector contractors to carry out “cyber operations for access generation and maintenance” under U.S. Cyber Command’s authority and Department of Defense oversight. Computer science experts define access operations as “how the hostile party gets at the IT of interest,” and the U.S. Air Force explicitly classifies access operations as offensive cyber operations.
The August presidential memorandum sidesteps Congress’s war powers altogether in favor of executive action and resembles other, even more expansive proposals. The Scam Farms Marque and Reprisal Authorization Act of 2025, for example, seeks to use an obscure war power granted to Congress under the U.S. Constitution to issue letters of marque and reprisal to private actors, authorizing them to seize “the person and property” of any individual or entity designated as criminal under the proposed framework. As critics of that proposal noted, this envisions modern-day privateering, a system that played a fundamental role in the development of mercenary warfare. This fits with the private sector’s own understanding of cyber mercenaries: companies dedicated to carrying out offensive cyber operations on contract for a government.
The president’s August memorandum, while carefully avoiding the terminology, also allows the private sector to carry out offensive cyber operations against foreign actors. The cyber surveillance operations under the memorandum map neatly onto access operations as defined above. The memorandum expressly acknowledges that surveillance operations “entail accessing … information systems without authorization from the owner or operator or by exceeding authorized access” for the purposes of collecting information, “including information that can be used for future Cyber Effects Operations.” Cyber effects operations are defined as those resulting in the “manipulation, disruption, denial, degradation, or destruction of information systems, networks, physical or virtual infrastructure controlled by information systems, or information resident thereon.” But program directors may not authorize any cyber effects operations that would result in “critical outcomes,” specifically “in the loss of life or serious injury; or … rise to the level of use of force or armed attack under international law.”
Who is Ultimately Responsible for Cyber Operations Under the Program?
The United Nations Charter prohibits States from the threat or use of force against other States under Article 2(4) and establishes the right of States to engage in individual or collective self-defense in response to an armed attack under Article 51. The debate about the difference between a use of force and an armed attack is beyond the scope of this piece, except to note that many States have asserted there is indeed a difference in their national positions on the applicability of international law in cyberspace. Additionally, the memorandum prohibits operations that could result in either a use of force or armed attack.
More importantly, the UN prohibition applies to States while the August memorandum in question concerns activities by private actors under the guidance and oversight of government authorities. Why, then, would the thresholds for use of force or armed attack be relevant to this program? Given the direct involvement and control of the program by the government, the answer is that the program’s structure means the United States would be responsible for any breaches of international law committed by the participating companies.
According to the International Law Commission’s commentary to the Draft articles on Responsibility of States for Internationally Wrongful Acts (ARSIWA), internationally wrongful acts can only be attributed to a State when it concerns “organs of government, or of others who have acted under the direction, instigation or control of those organs, i.e. as agents of the State.” All government agencies enumerated in the presidential memorandum are indisputably agents of the State, including the Program Executive Directors from the Department of Justice and the Department of Homeland Security. However, neither the agencies nor program directors will actually carry out the operations described in the memo. That role belongs exclusively to the private companies.
Nevertheless, there are several ways the government would remain responsible for the actions of the private companies envisioned under this arrangement. For example, Under Article 5 of ARSIWA, the actions of a private company are attributable to the State when it is “empowered” by law to carry out “functions of a public character normally exercised by State organs.” This program is only necessary because the private sector is not simply permitted to carry out cyber operations of these kinds of its own prerogative; only the State is authorized to do so. The system envisioned by the memorandum essentially creates a delegation of government powers to these private actors.
Further, under Article 8, the conduct of a private entity or person can be attributed to the State if that person or group “is in fact acting on the instructions of, or under the direction or control of, that State in carrying out the conduct.” This is known as the effective control test and is used to determine whether the State’s involvement in the activities in question is of a sufficiently high degree as to say that it should remain responsible for acts carried out by another actor. Here participating companies “undergo rigorous vetting” to enter the program in the first place and are continuously assessed to ensure “their performance adheres to the strict operational procedures outlined in the implementation guidance.”
Although this guidance has not yet been made publicly available, this requirement implies the government will establish rules that the involved private companies must abide by. Further, the memorandum explicitly sets out that “any activity authorized by the Program must be conducted subject to the oversight, operational control, and legal authorities of the United States Government.” Lastly, program directors are required to “review every cyber operations package and provide written approval and direction to the Participating Company before action may be taken.” This structure envisions extensive involvement by the United States, which is to maintain control over operations — including which can or cannot be undertaken — even if the private entities ultimately carry out the approved operations.
When Do Cyber Operations Cross the Line?
The precise threshold under international law for when a cyber operation constitutes a use of force or armed attack has not been clearly settled. In its 2021 contribution to the UN Group of Governmental Experts on developments in technology and security, the United States recognized that “determining whether a cyber activity constitutes a use of force prohibited by Article 2(4) of the UN Charter and customary international law or an armed attack” is “necessarily a case-by-case, fact-specific inquiry.” The U.S. position advised that “States should consider the nature and extent of injury or death to persons and the destruction of, or damage to, property.” It stated that cyber operations that “proximately” caused “death, injury, or significant destruction, or represent an imminent threat thereof” would likely meet the threshold. It adopted a common position among States that a cyber operation resulting in effects similar to those of “dropping a bomb or firing a missile” would constitute a use of force or an armed attack.
The United States is not alone in using the effects of a cyber operation to assess the threshold question. But some States have contemplated the possibility of operations that do not have physical damage as being able, under certain circumstances, to meet the threshold. The Netherlands, for example, said in 2019 that it “cannot be ruled out” that a cyber operation that results in “very serious financial or economic impact” could satisfy the test. Belgium’s 2025 position on the applicability of international law in cyberspace echoed a similar sentiment, noting that “it cannot be ruled out that a cyber operation that does not result in significant physical or human damage could be considered as a prohibited use of force.” It gave the example of an operation that paralyzed a country’s financial system or the functioning of critical infrastructure. Denmark’s 2023 position also contemplated the possibility that cyber operations classified as acts of “political coercion” could, under certain circumstances, be considered a use of force. International law scholars are similarly divided on whether and when non-destructive cyber operations could amount to a use of force.
Even more concerning for the August memorandum’s implementation is the growing acceptance of the accumulation of events doctrine to determine when a series of related sub-threshold events could, if taken together, amount to an armed attack. Several countries have affirmed in their national positions that a series of related incidents can constitute an armed attack if the aggregate consequences of the group of events satisfy the threshold. NATO has also noted that many of its member States recognize that “the impact of significant malicious cumulative cyber activities might in certain circumstances be considered an armed attack.”
Perhaps because of these risks, the presidential memorandum tries to stay clear of operations against other States. Cyber operations under the memorandum may only be conducted against a “foreign group that conducts cyber-enabled crime against the United States Government, a United States person, or United States interests, and,” that importantly “is not an institutional part of a foreign government or wholly operated under a foreign government’s direction.” Essentially, the memorandum prohibits operations taken against groups that could be considered state organs or state agents. However, “unless clear intelligence exists establishing such connection,” the memorandum contemplates that “a foreign group will be assumed not to be an institutional part of a foreign government or wholly operated under a foreign government’s direction.” It is unclear who should possess or share this intelligence, or who determines whether a group’s involvement with a foreign government is sufficient. Assuming a foreign group can be a target unless sufficient intelligence establishes otherwise will likely result in targeting many groups that fall in a gray area given the increasing involvement between adversarial governments and criminal groups.
Additionally, by the definition employed in the memorandum, these foreign groups will be located on the territory of other States and will presumably rely on infrastructure used by civilians, if not also by the territorial State. The effects of cyber operations would therefore likely go beyond just the foreign criminal groups and their individual devices and could — especially in a situation that quickly escalates — even impact critical infrastructure in the State in which the foreign groups are located.
Even if program directors undertake a “case-by-case, fact-specific inquiry” to only approve operations they feel will not pose a risk of resulting in a critical outcome, including in the aggregate with a view as to all the other operations, it is impossible to guarantee situations will not rapidly change. The memorandum acknowledges this possibility and directs the private sector companies to “immediately notify the NCC, which shall notify the Department of Justice” if they “develop a reasonable belief that an approved Cyber Effects Operation or Cyber Surveillance Operation may result in Critical Outcomes.” It is difficult to imagine that participating companies would have the necessary legal infrastructure to make such a difficult determination, especially when States themselves disagree on the issue and when these companies do not have a view of the whole of operations carried out under the program by other companies. This requirement offloads the critical assessment of when an operation may violate international law to a private sector entity for the sake of speed. The memorandum even requires participating companies to post a bond of at least one million dollars for any “non compliance with its contractual agreement.”
A Broader Global Pattern
Bond or no, the United States cannot easily offload responsibility for breaches of international law by these companies, whether above or below the threshold of use of force. A full analysis of how cyber operations under this program may violate the principle of sovereignty or the obligation of non-intervention is beyond the scope of this piece, but well worth considering, especially as the United States is not the only country seeking to expand cyber and surveillance powers to tackle transnational crime and foreign threat actors. We hope this series provides a useful comparative framework from which to begin these discussions and assess global trends, even those dressed up as unilateral actions.
