Federal agencies must coordinate against foreign cybercrime networks

The Secretaries of State, Treasury, War, and Homeland Security and the Attorney General must review existing efforts and submit an action plan to the President. The plan covers foreign transnational criminal organizations involved in cybercrime and schemes targeting U.S. people, businesses, critical infrastructure, or public services. The review must consult the Office of the National Cyber Director and coordinate with the Assistant to the President and Homeland Security Advisor. The plan must propose ways to prevent, investigate, disrupt, and dismantle the networks. The plan must include an operational cell within the National Coordination Center and may involve private companies. The review is due within 60 days of March 6, 2026, and the action plan is due within 120 days of that date.

The Attorney General must prioritize serious, provable cyber-fraud cases, while the Cybersecurity and Infrastructure Security Agency must provide training, technical help, and threat information to eligible government partners. The prosecution direction covers cyber-enabled fraud, including scam centers and sextortion. The security assistance covers state, local, Tribal, and territorial partners and their critical infrastructure. The prosecution direction applies consistent with federal prosecution principles. The security assistance must be provided to the maximum extent permitted by law. Implementation is subject to available appropriations.

Within 90 days, the Attorney General must recommend whether to establish a Victims Restoration Program. The proposed program would address victims of cyber-enabled fraud schemes and could use money recovered, forfeited, or seized from the responsible criminal networks. Any restoration or repayment would be allowed only to the greatest extent authorized by law. The order directs a recommendation, not the immediate creation of a repayment program or a guaranteed payment to victims. The recommendation is due within 90 days of March 6, 2026.

The Secretary of State must press foreign governments for enforcement and cooperation and take lawful, appropriate steps against governments that tolerate the activity. Possible steps include limiting foreign aid, imposing targeted sanctions, restricting visas or trade, and expelling complicit foreign officials or diplomats when appropriate. Actions must be consistent with U.S. law and policy. The State Department must coordinate with the National Coordination Center, allies, and partners. The order does not require every listed consequence in every case.