Executive Order 13757: Taking Additional Steps to Address the National Emergency With Respect to Significant Malicious Cyber-Enabled Activities

President: Barack Obama

Expanded cyber sanctions to information tampering and used them against Russian actors linked to the 2016 election interference.

Status: In effect.

Is Executive Order 13757 still in effect? Yes. EO 13757 remains an operative amendment to the EO 13694 cyber-sanctions framework, with that framework further amended in 2025 and its emergency continued in 2026.

What does Executive Order 13757 do?

EO 13757 changed the cyber-sanctions order after the 2016 U.S. election. Obama stated that the increasing use of malicious cyber activity to undermine democratic processes required additional measures. The order inserted an express designation criterion for tampering with, altering or misappropriating information for the purpose or effect of interfering with election processes or institutions. Signed order.

This was an amendment to EO 13694, not a separate general criminal prohibition on political expression. It retained the requirement that covered cyber-enabled activity pose a qualifying significant threat and have the relevant foreign connection. It also inserted an annex naming Russian intelligence services and related officers and organizations. Their property within U.S. jurisdiction or U.S.-person possession or control became blocked under the amended text, while other designations depended on Treasury findings in consultation with Justice and State. Signed order.

Administration position: Designation blocks listed property and dealings; it is not a criminal conviction and does not regulate ordinary political speech or good-faith security research.
SignedDecember 28, 2016
Base orderEO 13694
Regulations31 CFR part 578

Before and after

Before the order

EO 13694 already covered serious cyber harm to infrastructure, networks and economic resources, and the misuse of stolen trade secrets. It did not expressly identify election-process information tampering as its own category. EO 13757 added that category and placed specified persons directly in an annex, allowing the sanctions response to address the threat identified in the President's election-interference rationale. Signed order.

After the order

The amendments became effective at 12:01 a.m. Eastern Standard Time on December 29, 2016. Treasury could subsequently determine that blocking an annex-listed person was no longer warranted and take action to lift that restriction. OFAC's September 2022 rule incorporated EO 13757 into the comprehensive cyber-sanctions regulations. A June 2025 amendment to the underlying EO 13694 narrowed specified designation subsections to foreign persons. The 2026 continuation notice expressly included EO 13757 among measures under the continuing cyber emergency. Signed order. Sources: OFAC 2022 comprehensive cyber sanctions rule; 2025 changes to the underlying sanctions order; 2026 continuation of cyber emergency.

Who had to do what

Agency / officeActionTiming / position
Treasury Secretary / OFACApply amended criteria with Justice and State consultation; administer blocking and determine when circumstances no longer warrant blocking an annex-listed person.Amendments effective December 29, 2016 at 12:01 a.m. Eastern Standard Time; removal decisions as warranted.
Attorney GeneralConsult with Treasury on qualifying determinations and lifting blocking for annex-listed persons.When Treasury makes relevant determinations.
State SecretaryConsult on designation and unblocking decisions within the amended sanctions framework.When relevant determinations occur.

What happened next

Obama signed the election-interference amendment to EO 13694. Official source

The amendment and annex blocking became effective at 12:01 a.m. Eastern Standard Time. Official source

OFAC replaced its initial cyber regulations with comprehensive rules implementing EO 13694 and EO 13757. Official source

EO 14306 revised specified EO 13694 designation language to foreign persons. Official source

Trump continued the cyber emergency and expressly identified EO 13757 in the continuing framework. Official source