- What: An August 12, 2026 presidential memorandum stands up a National Coordination Center program, co-directed by DOJ and DHS, that authorizes vetted "Participating Companies" to conduct Cyber Surveillance Operations and Cyber Effects Operations against transnational criminal infrastructure.
- Impact: Participation carries a bond of not less than $1 million, mandatory disclosure of all contractual relationships, deconfliction with State, Treasury, War and the Intelligence Community, and judicial or other authorization for anything touching U.S. persons or domestic systems.
- Fix / mitigation: Treat the evidentiary burden as the design constraint. Cryptographic custody over artifacts, verification that works offline without the vendor, and telemetry infrastructure that runs disconnected and is lawfully exportable.
- Who's at risk: Any firm considering Participating Company status, and any critical-infrastructure operator whose logging platform cannot produce an artifact a hostile third party can independently verify.
On August 12, 2026, the White House issued a presidential memorandum titled Expanding Capabilities to Combat Transnational Cyber-Enabled Crime. Most of the early coverage will focus on the headline: the federal government intends to partner with vetted private United States companies to go after transnational criminal infrastructure directly.
That is the interesting part. It is not the hard part.
What the Memorandum Actually Does
The memorandum stands up a National Coordination Center program with the Department of Justice and the Department of Homeland Security as co-Executive Directors, coordinated through the National Security Council. State, Treasury, War, and the Intelligence Community are written into the operational deconfliction procedures.
It authorizes a category of vetted firms, called Participating Companies, to conduct two classes of activity: Cyber Surveillance Operations, meaning intelligence collection from foreign systems, and Cyber Effects Operations, meaning the manipulation or disruption of criminal infrastructure. The framing is explicit about the arrangement: "partnering with vetted United States companies subject to the direction and oversight of the Federal Government."
- Within 60 days · Operating ProceduresThe participating agencies must establish consensus operating procedures governing how the program runs.
- Within 180 days · Status ReportAn initial program status report is due, and annually thereafter.
- Ongoing · DeconflictionState, Treasury, War, and the Intelligence Community are part of the operational deconfliction process for every action.
- Condition of entry · Bond and DisclosureParticipating Companies must maintain a bond of not less than $1 million and disclose all contractual relationships.
- Hard limit · U.S. PersonsOperations touching U.S. persons or domestic systems require "necessary authorization, judicial or otherwise."
Read the Obligations, Not the Authorities
Strip out the operational language and look at what the memorandum actually requires of a Participating Company. A bond. Disclosure of every contractual relationship. Deconfliction across four departments and the Intelligence Community. And for anything touching United States persons or domestic systems, judicial or other authorization.
Every one of those is an evidentiary requirement wearing operational clothing.
A bond is a statement that someone expects to adjudicate harm. A disclosure regime means the government intends to reconstruct who was working for whom, and when. Deconfliction across five organizations means someone will later need to establish exactly what your operation touched, at what time, and whether it collided with another equity. Judicial authorization means a court will eventually look at your records, and a defense attorney will look at them harder.
An operation that succeeds and cannot be reconstructed afterward is not a success. It is a liability that has not matured yet. Under this program, the record you keep is the thing that will be examined, long after the operation itself is over.
The Infrastructure Problem Nobody Is Going to Lead With
Consider what a Participating Company has to hold, and for how long. Full-fidelity telemetry of its own operations, because the government will ask what you did. Collection from foreign systems, which is high-volume, frequently unstructured, and often gathered in environments with no reliable connectivity. Records of every analyst action, because the disclosure regime is about people as much as systems. All of it retained across a program that reports annually and an oversight posture that will outlive any single operation.
Then consider the standard it has to meet. Not "we have logs." Something closer to: an artifact whose integrity can be demonstrated by a third party who does not trust you, does not have access to your systems, and is being paid to find the gap.
Most security platforms fail that test in a specific and predictable way. They price by ingested volume, so the operator collects less than the record requires. They store data in a proprietary format, so producing it means producing it through the vendor. They treat export as a report-generation feature rather than a cryptographic one, so the chain of custody is a PDF with the words "chain of custody" at the top. And they assume connectivity, which is precisely the assumption that fails in the environments this program targets.
What Actually Holds Up
Three properties matter, and they are engineering properties, not policy ones.
Custody has to be cryptographic, not procedural
An artifact needs a content hash and a signature over a binding payload that includes the hash, the timestamp, the case, the artifact identity, the ingesting actor, and the source event. If the signature only covers the hash, it can be lifted onto different content. The custody record has to be append-only and versioned, never mutated in place, and the ledger underneath it has to be an append-only Merkle tree with domain-separated leaf and interior prefixes so the proof itself resists second-preimage attack. Every read and every verification gets logged with actor, time, and stated justification.
Verification cannot require the vendor
This is the one most platforms get wrong. If proving your evidence means running the vendor's platform, then the opposing expert has to trust your infrastructure in order to check your claim, which is not verification. The verifier has to be a standalone signed binary that recomputes the hash, validates the signature, and walks the Merkle proof entirely offline, holding no secret and touching nothing.
It has to run disconnected
Air-gapped networks, isolated enclaves, single-box deployments in sensitive compartmented environments, and forward locations with no persistent link home. That means a static binary or container, offline license activation, and no assumption that a control plane is reachable. It also means the software has to be lawfully exportable, which is an unglamorous compliance question that quietly disqualifies a lot of tooling the moment an operation goes overseas.
Where RedEye Sits
We build Caver, a lakehouse SIEM that stores telemetry as open Parquet on storage you own, normalized to OCSF, searchable in place. It is licensed per deployment rather than per gigabyte, which is the difference between collecting what the record requires and collecting what the budget allows. On our own production deployment carrying roughly 100 GB per day, a warm 24-hour query returns in 453 ms, and storage compresses 48:1 against raw ingest.
We are not an offensive operator and we are not applying to be a Participating Company. We build the layer underneath: the telemetry, retention, and custody infrastructure that makes an operation defensible after the fact.
- The memo: reconstruct what an operation touchedCaver's Evidence Locker implements custody from primitives, not paperwork. SHA-256 artifact hashing, Ed25519 detached signatures over a binding payload, an RFC 6962 append-only Merkle ledger, immutable versioned custody records, and access logging with justification on every read.
- The memo: records a court will examineVerification runs through a signed standalone verifier binary that validates an artifact fully offline, with no connection to the platform and no access to a secret. An opposing expert can check your evidence without ever touching your infrastructure.
- The memo: operations against foreign systemsCaver is self-classified ECCN 5D002 and exports under License Exception ENC, 15 CFR 740.17(b)(1). Standard published cryptography only, not subject to ITAR, deployable to any non-embargoed destination with no individual export license.
- The memo: environments with no connectivityStatic binary, container, or Helm chart into air-gapped networks and single-box enclaves, with license activation that requires no internet connection.
- The memo targets criminal infrastructure that lands on OTCaver Industrial passively decodes Modbus TCP, DNP3, IEC 60870-5-104, S7Comm, BACnet/IP, EtherNet/IP, and OPC-UA, with content mapped to NIST 800-82, IEC 62443, the NIST CSF 2.0 industrial profile, and CISA and ICS-CERT advisories.
Export classification is the detail most vendors skip and most buyers discover late. A program built around operations against foreign infrastructure runs into it immediately. Our public classification statement is published at getcaver.com/export-compliance, which is where any evaluation of this should start rather than end.
The Sixty-Day Window
The memorandum gives the agencies sixty days to write consensus operating procedures. Those procedures will define what a Participating Company has to record, retain, and produce. Firms that wait for the procedures and then go shopping for a platform will be standing up evidence infrastructure under a deadline, which is the worst possible time to discover that your logging platform cannot produce an independently verifiable artifact.
The organizations that come out of this well will be the ones that treated the evidentiary burden as the design constraint from the start.
Built for the record, not just the alert.
Caver gives you cryptographic chain of custody, offline independent verification, and long-retention telemetry that runs air-gapped and exports lawfully. A working pilot is days of engineering, not a procurement cycle.
See Caver