--- title: "US directive allows private firms to conduct of… | Firevault" description: "US President Donald Trump has signed a memorandum permitting private firms to execute offensive cyber operations. The move raises new risks of retaliatory…" lang: en-GB json-ld: | [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "knowsAbout": [ "Offline Secure Storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/news/us-directive-private-firms-offensive-cyber-operations#webpage", "url": "https://fire-vault.com/news/us-directive-private-firms-offensive-cyber-operations", "name": "US directive allows private firms to conduct of…", "description": "US President Donald Trump has signed a memorandum permitting private firms to execute offensive cyber operations. The move raises new risks of retaliatory…", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/us-directive-private-firms-offensive-cyber-operations-1786723418300.png" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/news/us-directive-private-firms-offensive-cyber-operations#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/news/us-directive-private-firms-offensive-cyber-operations#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Learn", "item": "https://fire-vault.com/learn" }, { "@type": "ListItem", "position": 3, "name": "Knowledge Vault", "item": "https://fire-vault.com/learn/knowledge" }, { "@type": "ListItem", "position": 4, "name": "US directive allows private firms to conduct offensive cyber operations", "item": "https://fire-vault.com/news/us-directive-private-firms-offensive-cyber-operations" } ] }, { "@context": "https://schema.org", "@type": "NewsArticle", "headline": "US directive allows private firms to conduct offensive cyber operations", "description": "US President Donald Trump has signed a memorandum permitting private firms to execute offensive cyber operations. The move raises new risks of retaliatory attacks and collateral system disruptions.", "url": "https://fire-vault.com/news/us-directive-private-firms-offensive-cyber-operations", "image": [ { "@type": "ImageObject", "url": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/us-directive-private-firms-offensive-cyber-operations-1786723418300.png", "width": 1200, "height": 1200 }, { "@type": "ImageObject", "url": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/us-directive-private-firms-offensive-cyber-operations-1786723418300.png", "width": 1200, "height": 900 }, { "@type": "ImageObject", "url": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/us-directive-private-firms-offensive-cyber-operations-1786723418300.png", "width": 1200, "height": 675 } ], "thumbnailUrl": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/us-directive-private-firms-offensive-cyber-operations-1786723418300.png", "author": { "@type": "Person", "name": "Mark Fermor", "jobTitle": "Director & Co-Founder", "worksFor": { "@id": "https://fire-vault.com/#organization" }, "url": "https://fire-vault.com/why-oss/about" }, "publisher": { "@type": "NewsMediaOrganization", "name": "Firevault", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 600, "height": 60 } }, "datePublished": "2026-08-14T16:02:03.908+00:00", "dateModified": "2026-08-28T08:03:36.979668+00:00", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://fire-vault.com/news/us-directive-private-firms-offensive-cyber-operations" }, "inLanguage": "en-GB", "articleSection": "Breach Analysis", "wordCount": 572, "keywords": "Breach Analysis, data breach, cyber security, offline secure storage, data protection, physical air gap", "articleBody": "According to reporting by The Guardian, United States President Donald Trump has signed a national security presidential memorandum that authorises private sector organisations to conduct offensive cyber operations against foreign criminal entities. The directive permits vetted commercial companies to carry out digital actions under the direction, control, and authority of federal agencies. What h", "dateline": "United Kingdom", "speakable": { "@type": "SpeakableSpecification", "cssSelector": [ "h1", ".article-summary", "h2" ] }, "isAccessibleForFree": true, "copyrightHolder": { "@id": "https://fire-vault.com/#organization" }, "copyrightYear": 2026 } ] --- Recent Breaches Breaches [2026 PowerSchool 62.4M records ](/learn/breaches)[2026 DISA Global Solutions 3.3M records ](/learn/breaches)[2026 Globe Life 850K records ](/learn/breaches)[2026 Lidl GB Customer contact data ](/learn/breaches)[2026 Asahi Group Production systems disrupted ](/learn/breaches)[2026 Kido International 8K records ](/learn/breaches)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](/learn/breaches)[2026 Jaguar Land Rover Production and IT systems disru... ](/learn/breaches)[2026 Peter Green Chilled Order and logistics data ](/learn/breaches)[2026 Adidas UK Customer contact details ](/learn/breaches)[2026 PowerSchool 62.4M records ](/learn/breaches)[2026 DISA Global Solutions 3.3M records ](/learn/breaches)[2026 Globe Life 850K records ](/learn/breaches)[2026 Lidl GB Customer contact data ](/learn/breaches)[2026 Asahi Group Production systems disrupted ](/learn/breaches)[2026 Kido International 8K records ](/learn/breaches)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](/learn/breaches)[2026 Jaguar Land Rover Production and IT systems disru... ](/learn/breaches)[2026 Peter Green Chilled Order and logistics data ](/learn/breaches)[2026 Adidas UK Customer contact details ](/learn/breaches) [View All →](/learn/breaches) [![Firevault - offline secure storage, physically disconnected from the internet](/assets/logo-color-DBVl0KCg.png)](/) Products Solutions [Why OSS](/why-oss) More [Help](/help)[Get started](/get-started) Overview What happenedWhat the data means for the sectorThe Firevault viewWhat to do nextMore Resources [Knowledge Vault](/learn/knowledge)/ [News](/learn/knowledge?filter=news) News · Breach Analysis · 14 August 2026 # US directive allows private firms to conduct offensive cyber operations US President Donald Trump has signed a memorandum permitting private firms to execute offensive cyber operations. The move raises new risks of retaliatory attacks and collateral system disruptions. ![Mark Fermor](/assets/mark-fermor-aWtKNSv7.jpg) Mark Fermor Director & Co-Founder, Firevault 3 min read Share [](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Fus-directive-private-firms-offensive-cyber-operations)[](https://twitter.com/intent/tweet?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Fus-directive-private-firms-offensive-cyber-operations&text=US%20directive%20allows%20private%20firms%20to%20conduct%20offensive%20cyber%20operations%0A%0AUS%20President%20Donald%20Trump%20has%20signed%20a%20memorandum%20permitting%20private%20firms%20to%20execute%20offensive%20cyber%20operations.%20The%20move%20raises%20new%20risks%20of%20retaliatory%20attacks%20and%20collateral%20system%20disruptions.)[](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Ffire-vault.com%2Fnews%2Fus-directive-private-firms-offensive-cyber-operations)[](mailto:?subject=US%20directive%20allows%20private%20firms%20to%20conduct%20offensive%20cyber%20operations&body=US%20President%20Donald%20Trump%20has%20signed%20a%20memorandum%20permitting%20private%20firms%20to%20execute%20offensive%20cyber%20operations.%20The%20move%20raises%20new%20risks%20of%20retaliatory%20attacks%20and%20collateral%20system%20disruptions.%0A%0Ahttps%3A%2F%2Ffire-vault.com%2Fnews%2Fus-directive-private-firms-offensive-cyber-operations) ![Abstract digital concept representing offline network security and physical data storage](https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/us-directive-private-firms-offensive-cyber-operations-1786723418300.png) Abstract digital concept representing offline network security and physical data storage Why it matters ## What this means for organisations holding critical data US President Donald Trump has signed a memorandum permitting private firms to execute offensive cyber operations. The move raises new risks of retaliatory attacks and collateral system disruptions. In this analysis 1. 01 [What happened](#section-0) 2. 02 [What the data means for the sector](#section-1) 3. 03 [The Firevault view](#section-2) **On this page**[What happened](#section-0)[What the data means for the sector](#section-1)[The Firevault view](#section-2) According to reporting by The Guardian, United States President Donald Trump has signed a national security presidential memorandum that authorises private sector organisations to conduct offensive cyber operations against foreign criminal entities. The directive permits vetted commercial companies to carry out digital actions under the direction, control, and authority of federal agencies. ## What happened The presidential memorandum establishes a legal framework for commercial firms to partner with federal, state, local, tribal, and territorial agencies. Participating companies will collect intelligence on foreign criminal groups, officially designated as transnational criminal organisations, and propose offensive digital operations to disrupt those threats. Overseen by the Department of Homeland Security and the Department of Justice, the initiative will run through the national coordination centre of the homeland security taskforce. Vetted commercial firms will be authorised to carry out cyber surveillance operations and cyber effects operations against designated foreign targets. Official White House documentation defines cyber effects as actions that manipulate, disrupt, deny, degrade, or destroy information systems, networks, and physical or virtual infrastructure. To participate, private companies must maintain an escrow or financial bond of at least 1,000,000 dollars. The White House highlighted that foreign criminal groups pose ongoing threats through ransomware attacks and financial fraud. The executive action follows national policy documents published in March that proposed expanding commercial involvement in cyber operations. This comes after recent cyber incidents in the United States, such as targeted attacks against operational technology across more than 30 water facilities in Minnesota. ## What the data means for the sector The policy marks a significant shift in national security practice by granting private organisations duties traditionally restricted to government agencies. Allowing commercial entities to execute active cyber disruptions against foreign criminal groups creates new complexities for legal risk, international conflict, and threat management. Legal analysts and security experts have highlighted risks regarding escalation, collateral damage, and inter-agency coordination. When commercial organisations engage in cyber surveillance or destructive operations against foreign entities, those groups are likely to launch counter-attacks against the participating firms or their connected business partners. Furthermore, identifying criminal servers without affecting shared commercial infrastructure remains technically challenging. An offensive action intended for a criminal target could inadvertently degrade legitimate systems or impact innocent third parties. For commercial enterprises, the digital risk environment is becoming increasingly unpredictable. As the distinction between government operations and private defense blurs, non-participating organisations may still face indirect disruption or retaliatory strikes directed at broad supply chains. ## The Firevault view Mark Fermor, senior editor at Firevault, notes that privatising offensive digital actions will inevitably escalate risks for connected business infrastructure. When cyber operations actively involve commercial networks, the probability of destructive counter-attacks and unintended system degradation increases for all connected entities. In a landscape where active digital disruption is encouraged, relying exclusively on network-attached security controls creates serious vulnerability. Firevault advocates for [Offline Secure Storage](/offline-secure-storage)® (#OSS) to protect mission-critical information. Maintaining an air gapped, physically controlled copy of vital records keeps key assets disconnected from public and private networks. Should retaliatory strikes or collateral network disruptions compromise online systems, #OSS ensures that essential data remains completely protected and available for restoration. ## What to do next Organisations assessing their risk exposure under this shifting cyber framework should implement the following measures: - Identify and audit all critical digital assets, customer records, and operational databases. - Assess supply chain risk to determine if key technology partners participate in offensive cyber initiatives. - Implement #OSS to maintain air gapped, unalterable physical copies of core data. - Regularly test offline recovery processes to ensure rapid operational restoration following network disruption. Sources ## Where this reporting comes from 01 **Original report**Primary coverage referenced in this analysis [View original article](https://www.theguardian.com/us-news/2026/aug/13/donald-trump-private-companies-cyber-attack) About the author ![Mark Fermor](/assets/mark-fermor-aWtKNSv7.jpg) ### Mark Fermor [](https://www.linkedin.com/in/mfermor) Director & Co-Founder Co-founder of Firevault, focused on offline secure storage and protecting individuals and businesses from fraud, fines, loss and damage. Speaker, owner and advisor. [![Firevault Bunker, the protected physical location for Offline Secure Storage hardware](/__l5e/assets-v1/75208f4e-fc6f-46d8-80b9-606c43dfef28/firevault-bunker-building.webp)](/why-oss) The Firevault view**Offline Secure Storage® keeps a clean copy beyond the reach of an attacker.**[Why #OSS →](/why-oss) [![The nine Control modules arranged around the Firevault platform](/__l5e/assets-v1/829a8768-a871-41d0-8a79-3645ca7f5e83/platform-wheel.jpg)](/solutions/control) Control systems and access**Cut the physical paths attackers and third parties depend on.**[Explore Control →](/solutions/control) [![Firevault 2TB Vault hardware](/__l5e/assets-v1/ed09bfc1-2f0f-491d-b1aa-861542a5fb33/hero-vault-2tb.png)](/get-started) Get started**Get started, or talk to a member of the team.**[Get started →](/get-started) How Firevault would handle this ## Controls an auditor can physically verify Firevault gives you physical separation, named custody and evidenced access, so compliance claims about isolation and control are things you can show, not just assert. [Get started](/get-started)[Talk to the team](/demo) **Custody**Named, access-controlled hardware in a Firevault Bunker **Evidence**Access windows and retrieval events are recorded **Separation**Physical isolation that satisfies offline copy requirements **Jurisdiction**Stored where your regulatory position requires Related Reading ## You may also find these useful [ ![Trezor breach reaches 81,000 customers because a supplier never deleted the data](/images/news/trezor-shipmonk-data-breach-81000-customers-2026.jpg) Breach Analysis ### Trezor breach reaches 81,000 customers because a supplier never deleted the data A further 67,000 US customers who ordered between 2019 and 2021 were exposed, because Trezor's logistics provider kept data it had confirmed in writing it had deleted. 8 Sept 2026 3 min ](/news/trezor-shipmonk-data-breach-81000-customers-2026)[ ![Quinn Emanuel and McDermott breached as law firms become the soft route to client data](/images/news/law-firms-quinn-emanuel-mcdermott-data-breaches-2026.jpg) Breach Analysis ### Quinn Emanuel and McDermott breached as law firms become the soft route to client data Two more major US law firms have disclosed social engineering breaches, joining Herbert Smith Freehills Kramer, Goodwin Procter and WilmerHale. One compromised user account was enough. 8 Sept 2026 4 min ](/news/law-firms-quinn-emanuel-mcdermott-data-breaches-2026)[ ![Mathspace breach exposes more than one million students, staff and parents](/images/news/mathspace-data-breach-one-million-students-2026.jpg) Breach Analysis ### Mathspace breach exposes more than one million students, staff and parents An unpatched self-hosted reporting system gave attackers seventeen days inside Mathspace, exposing names and email addresses for 1,079,819 people across Australia and New Zealand. 8 Sept 2026 4 min ](/news/mathspace-data-breach-one-million-students-2026)[ ![AnMed Closes Facilities Following Ransomware Attack and Data Claims](https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/anmed-facility-closures-following-ransomware-cyberattack-1786723492583.png) Breach Analysis ### AnMed Closes Facilities Following Ransomware Attack and Data Claims South Carolina health system AnMed was forced to close 83 facilities following a cyberattack. Threat actors subsequently claimed to hold 6 terabytes of sensitive patient records. 14 Aug 2026 4 min ](/news/anmed-facility-closures-following-ransomware-cyberattack)[ ![Adobe Commerce attacked immediately after session breach vulnerability](https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/adobe-commerce-session-vulnerability-exploited-after-disclosure-1786684691416.png) Breach Analysis ### Adobe Commerce attacked immediately after session breach vulnerability Security firm Sansec blocked attacks targeting Adobe Commerce immediately after disclosure. The flaw allows unauthenticated attackers to hijack sessions and customer data. 14 Aug 2026 4 min ](/news/adobe-commerce-session-vulnerability-exploited-after-disclosure)[ ![Cornelius faces legal investigation after alleged Cl0p cyber attack](https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/cornelius-alleged-clop-ransomware-data-breach-1786684482605.png) Breach Analysis ### Cornelius faces legal investigation after alleged Cl0p cyber attack Cornelius faces legal scrutiny following reports of a Cl0p ransomware breach in August 2026. Claims suggest thousands of gigabytes of corporate data were compromised. 14 Aug 2026 4 min ](/news/cornelius-alleged-clop-ransomware-data-breach) ## Suggested Reading - [What is Offline Secure Storage The foundation of physical disconnection ](/how-it-works/offline-secure-storage) - [Why Offline Secure Storage The case for physical control ](/why-oss) - [Ransomware Defence Hold gold copies offline ](/oss-for-ransomware-recovery) - [Control Physical path control for IT and OT ](/solutions/control) - [Knowledge Vault All articles, guides and whitepapers ](/learn/knowledge) - [Book a Demo See Firevault in action ](/demo) [Back to Knowledge Vault](/learn/knowledge)