By James Cervini, Director & Principal Architect, Operational Technology Cybersecurity, OSC Technical Solutions

A recent White House memorandum directs the establishment of a federally controlled program that can authorize vetted U.S. companies to participate in pre-approved cyber operations against foreign cyber-enabled transnational criminal organizations. While implementation details are still being developed, the basic model is clear: a company must be accepted into the program, operate under U.S. government direction and oversight, coordinate through established federal processes, and act only within the scope of an approved operation.

The memorandum also allows the Department of Justice or the Department of Homeland Security to require a participating company to maintain a bond or escrow of at least $1 million, subject to forfeiture for noncompliance. This is not an automatic entry fee, but it demonstrates that participation may carry substantial financial and operational accountability.

An Operational Technology Boundary

Operational technology is directly relevant to the program. The memorandum defines cyber effects operations broadly enough to include industrial control systems, embedded processors, controllers, and physical or virtual infrastructure controlled by information systems. It also requires participating companies to notify the National Coordination Center if they discover an imminent cyberattack against U.S. critical infrastructure or reasonably believe an approved cyber surveillance or cyber effects operation may produce a “Critical Outcome.”

That requirement establishes a clear hard line around high-consequence environments. The memorandum defines a Critical Outcome as an action likely to cause death or serious injury or rise to the level of a use of force or armed attack under international law. The program’s DOJ and DHS executive directors cannot approve operations expected to produce those outcomes. In other words, such risk is outside the program’s ordinary approval path and demands a higher level of government decision-making and control.

Conversely, if an approved participant becomes aware of an imminent threat to critical infrastructure, it must report that information immediately. This further illustrates the government’s prioritization of critical-infrastructure continuity. Yet “imminent” is not defined in the memorandum. In an OT environment, where adversaries may quietly pre-position access well before an intended disruption, that omission matters. Is verified pre-positioning itself imminent, or must defenders know that an attack is planned for a particular time? The implementation guidance will need to answer that question.

The Unresolved Operational Questions

Many other questions remain. The program must establish how it will measure attribution confidence, distinguish adversary-controlled systems from co-opted infrastructure, evaluate criminal groups with partial or indirect state support, manage collateral effects, protect third-party systems, and allocate responsibility for unintended consequences. The target definition is especially important: the memorandum applies to foreign criminal organizations that are not institutional parts of a foreign government or wholly directed by one. That leaves difficult cases in which a criminal group may tolerate, assist, or receive limited support from a state without being fully controlled by it.

The government must also determine how operational packages will be reviewed, how quickly approvals can be issued, what evidence must be retained, and how companies will deconflict their work with federal law enforcement, the Intelligence Community, and other departments. The program will succeed only if it can move faster than transnational criminal networks without lowering the standards for attribution, authorization, safety, and accountability.

What This Means for OSC Technical Solutions

For OSC Technical Solutions, the memorandum reinforces the connection between cybersecurity, secure engineering, and mission assurance across nuclear and critical-infrastructure environments. Effective action in OT and industrial control systems requires more than offensive technical skill. It demands accurate asset and network visibility, deep understanding of physical processes, disciplined change control, segmented architectures, secure access, continuous monitoring, and clear escalation procedures. Those capabilities protect mission systems while producing the high-confidence evidence and operational context needed to support lawful, government-directed action without creating unacceptable risk to safety or continuity.

A Significant First Step

Despite the open questions, the memorandum represents a significant first step in formalizing private-sector participation in government-directed cyber operations. It creates a framework for bringing commercial expertise into operations that previously remained largely within government, while preserving federal control and legal authority.

Future program growth could expand the eligible target set, permit time-bound campaigns rather than approval of isolated operations, and encourage structured access enablement and intelligence sharing. Any expansion, however, should retain the same hard line around critical infrastructure: strong attribution, narrow targeting, documented approval, operational deconfliction, rapid termination when boundaries are crossed, and clear accountability for every effect created.

Source

White House Memorandum: Expanding Capabilities to Combat Transnational Cyber-Enabled Crime