Cyber Letters of Marque and Reprisal Act
- Sponsor
- Rep. Burchett, Tim [R-TN-2]
- Committees
- Foreign Affairs Committee (primary)
- Last action
- Jul 15, 2026
Bottom line
The bill revives an ancient constitutional power to deputize private actors for modern cyber warfare and asset recovery, potentially transforming how the U.S. responds to cybercrime and state-sponsored attacks.
What it actually does
This bill authorizes the President to issue "cyber letters of marque and reprisal" to private entities, allowing them to conduct offensive cyber operations against designated foreign cyberthreats located outside the United States. These operations include intelligence collection, asset seizure (especially digital assets), disruption of malicious infrastructure, and other actions to disrupt, degrade, deny, or destroy information systems of designated cyberthreats. The bill aims to recover stolen funds for American victims and establish a bounty program.
Proponents argue
Proponents argue that traditional law enforcement and military responses are too slow and ill-equipped to combat the "machine speed" of modern digital asset crime and state-aligned cyberattacks. They contend that empowering the private sector, which often possesses specialized expertise and agility, can more effectively deter threats, recover stolen funds for victims, and protect national security interests in cyberspace. This approach leverages constitutional authority to modernize defense tactics.
Opponents contend
Opponents would likely raise concerns about the potential for unintended escalation of cyber conflicts, the difficulty of controlling private actors in sensitive national security operations, and the risk of misidentification or collateral damage. They might argue that deputizing private entities could blur lines of accountability, violate international law, or lead to a "Wild West" scenario in cyberspace, potentially harming U.S. foreign relations and increasing global instability.
The bill is concise and can be read quickly, but its implications are vast and require significant consideration beyond the text itself.
Section 5(a)
Presidential Authority to Issue Cyber Letters
This provision grants the President the authority to commission private individuals and entities with "cyber letters of marque and reprisal." These commissions allow private actors to conduct specified cyber operations, including disrupting, degrading, seizing, and repatriating assets or infrastructure of designated foreign cyberthreats located outside the United States.
Supporters argue
Supporters argue this is a necessary modernization of a constitutional power, enabling a more agile and effective response to rapidly evolving cyber threats that outpace traditional government capabilities.
Critics contend
Critics might argue this delegates inherently governmental functions to private entities, raising questions about accountability, oversight, and the potential for mission creep or unintended international incidents.
Tradeoffs
Balances the need for agility and specialized private sector expertise against concerns about government control, accountability, and the potential for miscalculation in sensitive cyber operations.
Section 4(2) and Section 5(g)
Definition and Authorization of Offensive Cyber Operations
The bill broadly defines "cyber operation" to include intelligence collection, data recovery, asset seizure (including digital assets), disruption of malicious infrastructure, and other proactive actions to disrupt, degrade, deny, or destroy systems of designated cyberthreats. Crucially, it explicitly authorizes letter holders to conduct "limited offensive cyber operations," including the use of malware and other offensive tools, to achieve these objectives.
Section 5(e) and 5(f)
Asset Recovery and Bounty Program
The bill allows the President to require up to 15% of assets recovered by letter holders to be forfeited to the U.S. to fund a bounty program for future cyber operations. It also authorizes bounties for letter holders and allows non-letter holders to receive up to 5% of recovered assets for providing information. Any remaining funds are to be deposited into the Crime Victims Fund.
Section 8
Immunity for Authorized Actions
This section states that no legal cause of action can be maintained against the holder of a letter of marque and reprisal for any act that is "expressly authorized" by that letter. This grants broad immunity from civil and potentially criminal liability for actions taken under the commission.
Section 5(c) and 5(d)
Limitations on Operations and Recordkeeping
The bill explicitly prohibits letter holders from knowingly conducting operations against any U.S. citizen or entity. It also mandates that any letter holder must keep a log of all activities conducted and assets seized for a period of not less than five years.
Section 6 and Section 7(2)
Expansion to Traditional Domains
This provision states that if Congress authorizes traditional letters of marque and reprisal for activities at sea, on land, in air, or in space, then holders of cyber letters shall also be authorized to conduct operations in these physical domains, to the extent permitted by the President. The President is also authorized to issue guidance on the extent of such expanded operations.