White House Cyber Memo Clashes With Congressional Authority

The Branch That Was Asked Never Voted, and the Judge Is Gone

A committee that receives no report has to start an oversight fight rather than continue one, and starting is the part that can be declined. Where the operative rules are classified and the only recurring artifact runs to the executive, the choice of instrument has already settled who gets to ask.

Legislative Affairs. Five bills, each a letter-of-marque bill by its own official title, sought this authority since February 2025 and none passed, and the memorandum issued 28 days after the most recent pair, on a different theory. There is no congressional addressee anywhere in it: the Section 3(c) status report goes to two executive-branch officials. The covert-action statute would ordinarily supply one, since 50 U.S.C. 3093 requires a written presidential finding and notification to the congressional intelligence committees, and it excludes "traditional law enforcement activities conducted by United States Government law enforcement agencies or routine support to such activities." Wiiver's inference is that the same "Federal law enforcement" characterization supplying the 1030(f) theory also reaches that exclusion. No source located indicates the administration has invoked it, and it may not need to, because covert actionActivity to influence conditions abroad where the government's role is intended to be unacknowledged, triggering a written presidential finding and notice to two committees. requires that the government's role "not be apparent or acknowledged publicly," and this Program was announced in a published memorandum. Section 4(d) defines surveillance operations as conducted "with the intent to remain undetected," which conceals the operation rather than the government's role, and the 2018 provision is what drew that line. Title 10, Section 394(c) makes a clandestine cyber operation a traditional military activity for the purposes of Section 3093(e)(2), and Section 394(d) requires the Secretary to brief the congressional defense committees quarterly on those same operations. The law-enforcement exclusion carries no such briefing duty, and its own limiting word is "traditional." On the public record, and subject to a classified finding that would not appear on it, no congressional committee is a named recipient of anything in this Program. The precedent for how long an access fight takes is NSPM-13, signed in August 2018 and shown to the House Armed Services Committee in March 2020. Seven months before this memorandum, the House Homeland Security Subcommittee on Cybersecurity and Infrastructure Protection held a hearing titled "Defense through Offense," at which Emily Harding of the Center for Strategic and International Studies asked Congress for the opposite of what arrived: "Put in place protections for cyber operators who act in conjunction with the U.S. government."

Cybersecurity & Privacy. Private disruption of criminal infrastructure is not new, and this is the part of the story most easily lost. Microsoft's Digital Crimes Unit has brought roughly forty civil actions since 2008, including actions against Lumma Stealer in May 2025 and Fox Tempest in May 2026, with named causes of action running from the Computer Fraud and Abuse Act to trespass to chattels. A judge signs the order and a docket records it. The memorandum keeps the private operator and removes the judge: approval moves to two executive directors applying a classified adjudicatory framework, and the authorized effect widens from seizure to destruction at the same moment. Rule 41(b)(6) authorizes a warrant to search and to seize or copy; it does not authorize destruction.

Not everyone reads it that way, and the contrary reading deserves stating. Wiley, in a client alert published two days after signing, argues the memorandum "does not purport to authorize vigilantism or so-called 'offensive' cyber capabilities by the private sector," because express written government approval is required before any Cyber Effects Operation. On that reading the operator is a contractor executing a government decision, and the program echoes the review-and-approval model established for military cyber operations in 2018.

Clean targeting is hard even with a judge. Microsoft's action against No-IP took roughly 1.8 million uninvolved customers offline, on No-IP's own account, while the most surgical example runs the other way: deleting PlugX from approximately 4,258 US-based computers took nine warrants between August 2024 and January 3, 2025, in a French-led operation, using only the malware's own self-delete command. Its target is the instructive part, because PlugX was built for a group the Justice Department says the Chinese government paid. Section 4(c) would put that target outside the Program's reach, but only once the state connection was established, which here took years of investigation and an unsealed court record. Before that, Section 4(c)'s default would have placed it inside. Proportion is the rest of the problem: De Silva et al., in USENIX Security '21, working from 2019 scan data, found 81.7 percent of malicious websites sit on apex domains the attacker does not own. Section 4(c) meanwhile defaults toward permission, providing that a foreign group "will be assumed not to be" state-directed "unless clear intelligence exists," so state-adjacent crews sit inside the target set during the weakest attribution window. A student Note in the Columbia Business Law Review, published July 16, 2026, four weeks before the memorandum, proposed a closely similar arrangement of cleared contractors on the same exception, and built in the safeguard the Program inverts: a contractor who identifies a nation-state actor should "immediately stop all operations and hand over active control." The permissive default is not hypothetical this summer: water and wastewater utilities in at least seven states reported incidents to the FBI after July 27, 2026, and a coordinated attack hit operational technology at more than thirty Minnesota community water systems on July 26 and 27. CISA has attributed similar earlier PLC activity to a group affiliated with Iran's Revolutionary Guard, and federal officials have not attributed this wave. The fact pattern is simultaneously the class of actor Section 4(c) presumes away and the class of effect Section 4(a) authorizes American companies to produce abroad, bounded by a floor set at loss of life, serious injury, or a use of force under international law, the second of which the memorandum defines nowhere and leaves entirely to the two approving directors.

The Company in the Middle of a Two-Sided Market

A firm that sits between the customers supplying its threat information and the government selecting its targets is not merely serving two markets. It is positioned to shape the second with what it learns from the first, and disclosure that runs only to the party doing the selecting leaves the party supplying the data unable to see the arrangement at all.

Strategy & Operations. The memorandum is unusually clear about what a company owes and silent about what it gets. Qualification, the forfeitable bond, disclosure of every commercial relationship, reporting into the National Coordination Center, an abort-and-minimize duty, escalation duties and annual re-evaluation are all specified; compensation, fee, reimbursement and any share of what is recovered are absent from the operative text. Whether the Section 2(a)(ii) contracts supply what the memorandum does not is the thing to watch on October 11. The only funding clause, Section 5(b), makes the Program "subject to the availability of appropriations," which is a limit on the government rather than a promise to the company. Section 3(a)(ii) promises room for "smaller, more agile companies," and the memorandum requires facility security without saying how a small firm obtains it. Under 32 C.F.R. 117.9 "a contractor or prospective contractor cannot apply for its own entity eligibility determination," so on the face of that rule sponsorship comes from a government activity or a cleared contractor. The opening to small firms reads as a discretion reserved rather than a market opened.

Practitioners are already pricing it that way. Jason Kikta, formerly of US Cyber Command and now chief technology officer at Automox, told SiliconANGLE the arrangement is "a perpetual motion machine for billable threats."

AI & Data Science. Section 2(a)(iii) lets a Participating Company take threat information from private customers and targets from government agencies, with the operation as the output, and Section 3(a)(iii) requires every such relationship to be disclosed to the National Coordination Center and to no one else. Federal acquisition has a name for the shape of that arrangement: impaired objectivityA conflict arising when a contractor evaluates or acts on matters affecting its own other business interests., which FAR 2.101 defines as a case where a contractor's objectivity in performing the work is or might be impaired. Whether those rules formally reach these agreements depends on whether the Justice and Homeland Security contracts are FAR contracts, and the memorandum does not say. The rewrite Congress ordered in Public Law 117-324 remains a proposed rule more than three years after enactment. The tension the next year will test is Section 3(b), which directs the National Coordination Center to "utilize automation to streamline Program elements wherever appropriate." That duty runs to the government hub rather than to the companies, and nothing exempts the per-package written approval that is the memorandum's only named human control.