Sentiment Analysis: Combating Cybercrime, Fraud, and Predatory Schemes Against American Citizens

Executive Order: 14390

Issued: March 6, 2026

Federal Register Doc. No.: 2026-04826

1) OVERALL TONE & SHIFTS‌‍⁠

The‌‍⁠ order opens with urgent, emotionally charged language framing cybercrime and fraud as existential threats to American families and youth, then transitions into procedural and directive language as it assigns agency responsibilities and timelines. The rhetorical register shifts noticeably from Section 1's victim-centered moral framing — emphasizing harm, vulnerability, and exploitation — to the bureaucratic and operational language of Sections 2 through 5, which specify interagency coordination mechanisms, action plan deadlines, and legal carve-outs.

The overall tone is assertive and protective, positioning the federal government as a defender against foreign criminal networks. The closing general provisions adopt the standard neutral-legal register common to executive orders, tempering the urgency of earlier sections with jurisdictional and appropriations caveats.

2) SENTIMENT CATEGORIES‌‍⁠

Positive sentiments (as the order frames them)

The order frames U.S. policy as protective and restorative, stating the government will "protect Americans" and "provide support to victims"
The order frames interagency coordination and private-sector partnership as constructive tools for enhancing national cyber resilience
The order frames international engagement with allies as a force-multiplying positive action against shared threats
The Victim Restoration Program is framed as a remedial good — returning seized funds to harmed individuals

Negative sentiments (as the order describes them)

The order describes TCOs as predatory actors "draining American families of their life savings" and "destroying the lives of our youth"
The order characterizes foreign regimes as complicit enablers, stating they provide "willing or tacit state support to cybercrime," fueling a "shadow economy"
The order frames scam centers, ransomware, sextortion, phishing, and human trafficking as coordinated, systemic harms targeting "the most vulnerable"
Nations that "tolerate" predatory activity are framed negatively as deserving of consequences including sanctions, trade penalties, and diplomatic expulsion

Neutral/technical elements

Establishment of an operational cell within the National Coordination Center (NCC), referencing Executive Order 14159 of January 20, 2025
Specific timelines assigned: 60-day review, 90-day victim program recommendation, 120-day action plan submission
Enumeration of responsible officials: Secretary of State, Secretary of the Treasury, Attorney General, Secretary of Homeland Security, Office of the National Cyber Director
Standard legal savings clauses in Section 5 preserving existing agency authority, OMB functions, and appropriations conditionality
Attribution of publication costs to the Department of Homeland Security

Context for sentiment claims

The order provides no citations, statistical evidence, or sourced data to support claims about the scale of harm (e.g., dollar amounts drained from families, number of victims)
The assertion that "foreign regimes provide willing or tacit state support" is stated as established fact without reference to intelligence assessments or prior legal findings
The characterization of TCOs as targeting "the most vulnerable" is asserted rhetorically rather than defined or operationalized
The order references Executive Order 14159 (on immigration enforcement) as the basis for the NCC, linking cybercrime response infrastructure to a separate policy domain without elaboration

3) SECTION-BY-SECTION SENTIMENT PROGRESSION‌‍⁠

Section 1 — Purpose and Policy

Dominant sentiment: Urgent moral alarm combined with a protective policy commitment on behalf of American victims.
Key phrases: "destroying the lives of our youth"; "shadow economy fueled by stolen identities"
Why this matters: The emotionally loaded framing establishes the normative justification for the broad multi-agency mandate authorized in subsequent sections. Section 1 also states that the U.S. response may include "potential offensive actions," though this phrase appears only in the policy declaration and is not operationalized or given specific legal form in Sections 2–5.

Section 2 — Combating Scam Centers and Cybercrime

Dominant sentiment: Operationally directive and institutionally constructive, with an underlying adversarial orientation toward foreign TCOs.
Key phrases: "dismantle these TCOs"; "detect, disrupt, dismantle, and deter"
Why this matters: The quadruple-verb formulation ("detect, disrupt, dismantle, deter") signals an escalatory posture. The section focuses on interagency coordination, action plan development, private-sector integration, and SLTT capacity-building rather than specifying offensive measures.

Section 3 — Victim Restoration Program

Dominant sentiment: Remedial and victim-centered, with a tone of institutional accountability toward harmed individuals.
Key phrases: "restoration or remission to victims"; "funds clawed back, forfeited, or seized"
Why this matters: The order frames asset forfeiture — typically a law enforcement revenue mechanism — as a victim-benefit instrument, which represents a rhetorically distinct and sympathetic framing of prosecutorial outcomes.

Section 4 — International Engagement

Dominant sentiment: Unusually punitive and confrontational toward non-cooperative foreign governments, with a cooperative tone reserved for allied nations.
Key phrases: "demand enforcement actions"; "shall face consequences"; "immediate expulsion from the United States of foreign officials and diplomats complicit in these schemes"
Why this matters: Section 4 is the most rhetorically aggressive section of the order. It does not merely signal displeasure with non-cooperative states — it explicitly enumerates a retaliatory menu including targeted sanctions, visa restrictions, trade penalties, limitation of foreign assistance, and the expulsion of complicit foreign officials and diplomats. The directive that the Secretary of State "demand" enforcement and ensure nations "shall face consequences" is notably coercive language for a diplomatic engagement provision, framing international relations in this domain as enforcement-oriented and punitive rather than collaborative by default.

Section 5 — General Provisions

Dominant sentiment: Legally neutral and procedurally conservative, consistent with standard executive order boilerplate.
Key phrases: "consistent with applicable law"; "subject to the availability of appropriations"
Why this matters: These provisions limit the order's enforceable scope and signal that implementation is contingent on existing legal authority and congressional funding, tempering the assertive tone of earlier sections.

4) ANALYTICAL DISCUSSION‌‍⁠

Alignment‌‍⁠ of sentiment with substantive goals

The order's emotional framing in Section 1 — centering vulnerable victims, destroyed youth, and stolen savings — serves a clear rhetorical function: it constructs a moral urgency that justifies the broad, multi-agency mandate and establishes the policy aspiration of "potential offensive actions," a phrase that appears in the declaratory section but is not given specific legal or operational form in the sections that follow. The sentiment architecture moves from harm identification (Section 1) to institutional response (Section 2) to victim remedy (Section 3) to international coercion (Section 4), creating a logical emotional arc that mirrors a law enforcement narrative structure: crime, investigation, prosecution, restitution, and deterrence. This alignment between tone and structure is deliberate and internally consistent. The order's positive sentiments — protection, restoration, coordination — are consistently paired with negative characterizations of TCOs and non-cooperative foreign states, reinforcing a binary framing of the policy landscape.

Potential impacts on relevant stakeholders

The order's language has differential implications for identifiable stakeholder groups. Victims of cyber-enabled fraud are addressed sympathetically and are the stated beneficiaries of the Victim Restoration Program, though the order conditions this on funds actually seized and on the Attorney General's discretionary recommendation. State, local, Tribal, and territorial governments are framed as partners requiring capacity-building support, suggesting the order perceives a gap in sub-federal defensive capability. Foreign governments — particularly those the order characterizes as tolerating TCO activity — are addressed in strikingly coercive terms, with the Secretary of State directed to "demand" enforcement and impose a specific and expansive set of consequences up to and including the expulsion of foreign officials and diplomats. Private-sector cybersecurity firms are framed as operational partners rather than regulated entities, a notably cooperative rather than regulatory posture. The order's reference to "Secretary of War" (an archaic title not used in current U.S. government structure since 1947, when it was replaced by "Secretary of Defense") is a notable textual anomaly in the document.

Comparison to typical executive order language

The order's Section 1 is more emotionally explicit than is typical for executive orders, which conventionally open with policy statements in neutral administrative language. Phrases such as "destroying the lives of our youth" and "shadow economy fueled by stolen identities, coercion, forced labor, and human trafficking" are more characteristic of political speeches or legislative findings than standard executive order preambles. The directive sections (2–4) are more conventionally structured, using standard interagency coordination language and timeline-based mandates, with the notable exception of Section 4's unusually punitive diplomatic language. The general provisions in Section 5 are entirely standard boilerplate. The overall document thus blends campaign-style rhetorical framing with conventional administrative machinery, a pattern observed in several executive orders issued during political transition periods when establishing public-facing policy identity is a concurrent goal alongside operational direction.

Character as a political transition document and analytical limitations

The order exhibits characteristics common to early-term executive orders: it establishes new coordinating bodies, directs reviews and action plans rather than specifying final policy outcomes, and uses strong declaratory language to signal priorities without yet committing to specific resource allocations. The linkage of the NCC to Executive Order 14159 — an immigration enforcement order — is a structural choice that embeds cybercrime response within a broader national security and border enforcement framework, which reflects a particular ideological framing of these issues as interconnected. This analysis is limited by its focus on textual sentiment rather than implementation capacity, legal sufficiency, or empirical accuracy of the order's factual claims. The absence of evidentiary citations in the order means that the severity and scope of harms described cannot be independently assessed from the document itself. Additionally, sentiment analysis of policy documents captures rhetorical intent rather than operational effect, and the two may diverge significantly in practice.