President Donald Trump signed a presidential memorandum on Wednesday allowing vetted private companies to launch offensive cyber operations against transnational criminal organizations targeting Americans, in partnership with the Justice and Homeland Security departments.

The firms will conduct attacks and surveillance on cybercriminal networks, subject to advance approval from DOJ and DHS officials. No operation will be sanctioned if it risks loss of life or rises to the level of armed attack under international law. Companies must sign contracts, undergo vetting, report regularly to federal agencies and face at least $1 million in penalties for violations.

The White House said Americans reported $20.8 billion in cyber-related losses last year through scams, ransomware and cyberattacks. Federal agencies have two months to develop operating procedures and minimum standards for participating companies, which must demonstrate technical proficiency, facility security and personnel vetting.

Cybersecurity experts questioned the lack of legal protections in the memorandum and raised concerns about potential for foreign governments to target U.S, The Record reports.