US Presidential Memo Authorizes Selected Private Companies to Join Federal Cyber Operations Against Foreign Criminal Groups
The United States government has launched a new program that permits carefully selected private companies to take part in cyber operations against foreign criminal organizations. The presidential memorandum authorizing the initiative was signed by Donald Trump on 12 August 2026.
The program will be managed by the National Coordination Center and jointly directed by the Department of Justice and the Department of Homeland Security. Private firms may only participate through formal contracts and will remain under continuous federal direction, control, and supervision.
Authorized activities include network surveillance of criminal groups as well as operations designed to manipulate, interrupt, degrade, or disable digital systems used by transnational organizations. Primary targets encompass infrastructure linked to ransomware, phishing campaigns, financial fraud, and other scams directed at US citizens.
Selection and Contractual Requirements
Companies seeking to join the program must undergo rigorous assessments covering technical capability, operational history, physical security, and personnel reliability. Contracts may require a financial guarantee or deposit of at least US$1 million, which can be forfeited in the event of rule violations. Every individual operation requires written authorization before execution.
Safeguards and Prohibited Outcomes
The memorandum mandates procedures to prevent accidental impact on US citizens, businesses, or systems. Any such incident must trigger immediate cessation of the action and prompt notification to authorities. Activities carrying a risk of death, serious injury, or reaching the threshold of use of force under international law are classified as critical outcomes and cannot be approved by the program’s co-directors.
Final operational guidelines are required within 60 days. The decision represents a notable evolution in government policy by formally acknowledging that leading offensive cyber expertise now resides in the private sector and by establishing a structured channel to leverage that expertise under state oversight.
Related articles
Google to Back Unified robots.txt Standard for Blocking AI Training Data Use
Google has announced plans to support a common mechanism in robots.txt that allows website owners to opt out of having their content used for training generative AI models. The feature will be based on work by the AIPREF working group at IETF and is scheduled for rollout in 2027. Instead of issuing separate instructions to each AI provider, publishers will be able to set a single policy marker that participating companies are expected to respect. Google intends to treat an unspecified general marker the same way it currently handles its own Google-Extended directive. Existing per-company rules will continue to function, letting site owners combine a broad default with specific exceptions. The approach simplifies management as the number of AI crawlers grows, though compliance will remain voluntary and dependent on which organizations adopt the standard.
Who Pays When AI Agents Err: Insurance for AI Risks in Russia and the West
A typical 2026 scenario involves an AI agent connected to a CRM system that mistakenly deletes half of a company's customer database by misclassifying contacts as duplicates. The incident occurs without any cyber attack or malicious intent from developers, raising questions about liability among model developers, integrators, and the deploying company. Russian law places responsibility on humans or organizations under the National AI Strategy to 2030 and the AI Ethics Code, with harm assessed via general Civil Code provisions such as Article 1079 on sources of increased danger. Experimental legal regimes since January 2025 require mandatory insurance for AI-related harm in areas like autonomous vehicles and telemedicine, while Federal Law No. 243-FZ of July 2026 grants developers of sovereign AI models rights to insure liability and mandates technical documentation. A March 2026 draft law proposed detailed responsibility chains and exemptions but was significantly diluted in the final version. Internationally, no mandatory AI liability insurance exists in the US or EU, though specialized products from insurers like Armilla and Munich Re cover hallucinations, agent actions, and performance shortfalls, with real incidents already generating claims.
Russia's MinTsifry to Begin Issuing Official Code Signing Certificates in 2027
The Russian Ministry of Digital Development plans to start issuing state-backed code signing certificates for software developers in 2027, with corporate security certificates following in 2028. The initiative aims to help operating systems identify publishers and verify that code has not been altered after release. A draft government decree would grant MinTsifry the powers of a National Certification Authority, allowing it to set certificate requirements, issue and revoke certificates, define validity periods, and maintain a public registry. While the signature confirms origin and integrity, it does not guarantee the absence of vulnerabilities in the software. The law permits charging fees for certificates, but no decision on pricing has been made yet. Full recognition by operating systems, browsers, and app stores will be required, and foreign platforms are not obligated to trust the Russian certificates automatically.
Rostelecom Explores Underground Data Centers in Partnership With Norilsk Nickel for Stronger Physical Protection
Rostelecom is developing underground data centers as a third layer of protection against serious external threats. The first layer involves backup sites with data copies, while the second distributes computing power and services across geographically separated locations. The company is discussing the project with Norilsk Nickel, which could supply both underground facilities and its own power generation capacity. Experts from iKS-Consulting estimate that a buried data center would cost 30-40 percent more than a comparable surface facility due to requirements for waterproofing, ventilation, gas monitoring, specialized fire suppression, evacuation systems, and underground equipment transport. Sources indicate the plans were reported by Vedomosti citing a top Rostelecom executive and people familiar with the talks. No specific timelines, sites, or technical parameters have been disclosed yet.