Unique among the Department of Justice’s authorities is the ability to hold criminal actors accountable through arrests and prosecutions. It is the hallmark of the work that the Department pursues across a wide range of crimes, and it is similarly effective in preventing future threats. Charging, apprehending, and incapacitating actors to hold them responsible for their actions remains a priority in criminal cases.

The Department of Justice’s ability to combat threats, however, is not limited to arresting and prosecuting individual operators. Because the prevention of harm must be our first priority, throughout an investigation, prosecutors shall assess whether other disruptive actions aside from, or in addition to, apprehension of the threat actors could remedy or minimize the ongoing risk of harm in investigations involving cyber or cyber-enabled crimes or intellectual property offenses. Operations that will produce substantial disruptions of significant harmful activity should be prioritized, even if such actions might otherwise alert criminal actors of the nature or existence of the Department’s investigation. These disruptive actions should continue and expand to incorporate all available criminal, civil, national security, and administrative tools to dismantle the infrastructure used by criminals, as well as to deprive malicious actors of the fruits of their criminal actions, including through seizures and forfeitures of property derived from or involved in the criminal activity wherever possible.

For investigations governed by JM 9-51.100 and 9-51.101, at the outset of an investigation, and periodically as an investigation progresses, prosecuting offices will consult with investigative agencies about available online technical disruption options—such as taking control of domain names, servers, or digital assets with lawful authority, remote access search warrants, or injunctions under 18 U.S.C. §§ 1345 or 2521—and other disruption actions available to the Department, other U.S. government departments or agencies, foreign governments, and the private sector, including notifications and information sharing. Such consultations shall include CCIPS (including its National Cryptocurrency Enforcement Team), NatSec Cyber, the Counterterrorism Section (CTS), the Money Laundering, Narcotics and Forfeiture Section (MNF), the National Cryptocurrency Enforcement Team (NCET), or the Office of International Affairs, as appropriate. The Office of the Deputy Attorney General (ODAG) shall resolve any disagreements among investigative agencies, prosecuting offices, or other components regarding disruption actions.

[updated January 2026]