A CE-TCO designation rests on three conditions: the group is foreign, it is committing cyber-enabled crime against US persons or interests, and it is not part of or operated by a foreign government [4]. That last condition is the hardest call in attribution work, and here it gets made twice before anything runs: once by the company writing the operations package, then by program directors at Justice and Homeland Security, who also check that the operation will not interfere with other US government activity, will not kill anyone, and will not amount to an armed attack under international law [6].
The funnel into that gate is wide. Nominations can come from private sector entities or from any federal, state, local, tribal or territorial agency [5], which is six classes of nominator feeding two departments of approvers [1]. Tom Uren, who writes Seriously Risky Business, calls the nomination process ridiculously broad and would restrict it to agencies that actually respond to scams and cybercrime [7].
The capacity gap behind the memo is real. Policing has had limited impact on this category of crime, so the government moved toward disruption and cyber operations [14], and those operations are rationed: the FBI takes only the highest-priority groups, NSA is pointed at foreign intelligence, and Cyber Command works the warfare nexus [10]. Uren's count is hundreds of crews nobody is contesting [11].
Critics, in Uren's summary, raise two objections: an accidental hit on a foreign government triggering escalation, and foreign governments going after employees of participating companies [12]. Uren thinks both are overblown, citing WannaCry and NotPetya, neither of which brought significant consequences for the governments behind them [13]. That comparison is about states absorbing the fallout of state operations, which is a different question from what a foreign service does to the identifiable staff of a licensed contractor.
What is published amounts to three controls: vetting on technical proficiency, proven performance, facility security and personnel vetting [8]; pre-execution approval [6]; and a USD$1 million bond forfeited if the firm breaks its contract conditions [9], [2]. All three run toward the government. The memo does not describe any immunity or liability shield for a participating company; the bond is a remedy the government holds, not cover a firm can point to when a misidentified third party comes looking [3].
The logistics sit in a classified annex [2]. So when scam infrastructure goes dark next year, the people reading the wire outside the program have no way to separate a licensed cyber effects operation from a federal takedown or from one crew hitting another [3]. Attribution confusion runs in both directions here: outward at the targets, and inward at everyone else trying to interpret a disruption.
