Cyber Letters of Marque and Reprisal Act
- Sponsor
- Sen. Lee, Mike [R-UT]
- Committees
- Foreign Relations Committee (primary)
- Last action
- Jul 15, 2026
Bottom line
This bill revives an ancient constitutional power to deputize private actors for offensive cyber operations and asset recovery against foreign cyberthreats, aiming to combat digital crime and deter malicious state-aligned actors.
What it actually does
This bill authorizes the President to issue 'cyber letters of marque and reprisal' to private entities, empowering them to conduct specified cyber operations against designated foreign cyberthreats. These operations can include intelligence collection, data recovery, asset seizure (including cryptocurrency), disruption of malicious infrastructure, and limited offensive actions using malware. The bill also establishes a bounty program funded by recovered assets, with a portion potentially going to the Crime Victims Fund.
Proponents argue
Proponents argue that this legislation provides a novel, agile, and necessary mechanism to combat rapidly evolving cyberthreats and digital asset crime that often outpaces traditional government law enforcement and defense frameworks. They contend it leverages critical private sector expertise, facilitates the return of stolen funds to American victims, and introduces a powerful new deterrent against malicious foreign actors.
Opponents contend
Opponents might argue that deputizing private entities for offensive cyber operations carries significant risks, including unintended international escalation, misidentification of targets, and potential violations of international law. Concerns could also be raised regarding accountability, oversight, and the potential for a profit-driven bounty system to incentivize overly aggressive or risky actions by privateers, blurring the lines of state responsibility in cyberspace.
The bill is short and relatively straightforward, allowing for a quick understanding of its core provisions, though its implications are profound and warrant deeper consideration.
Section 5(a)
Presidential Authority to Issue Cyber Letters of Marque
This provision grants the President the authority to issue 'cyber letters of marque and reprisal' to private individuals and entities. These letters commission privateers to conduct cyber operations, including disrupting, degrading, seizing, and repatriating assets or infrastructure of designated foreign cyberthreats located outside the U.S. geographic boundaries and its territories.
Supporters argue
Supporters argue this provision modernizes a constitutional power to address contemporary cyber threats, leveraging private sector capabilities to act swiftly against malicious foreign actors and recover stolen digital assets more effectively than traditional government methods alone.
Critics contend
Critics may contend that this delegation of offensive cyber capabilities to private actors could lead to unintended international incidents, misidentification of targets, or a lack of sufficient government oversight over potentially sensitive operations, raising questions about state accountability.
Tradeoffs
This provision balances the perceived need for agile response to cyber threats with concerns about accountability, control, and the potential for private actions to complicate foreign relations or national security policy.
Section 4(2) and Section 5(g)
Definition and Authorization of Cyber Operations
The bill broadly defines 'cyber operation' to include intelligence collection, data recovery, asset seizure, disruption of malicious infrastructure, and 'other proactive actions intended to disrupt, degrade, deny, or destroy information systems or networks.' Section 5(g) explicitly authorizes 'limited offensive cyber operations, including the use of malware and other offensive tools targeting digital infrastructure' to carry out these operations.
Section 5(b)
Requirement for Security Bonds
Before issuing a letter of marque, the President may require the recipient to post a security bond in an amount deemed sufficient to ensure the execution of the letter's terms and conditions. If the recipient violates these terms, part or all of the posted bond may be forfeited.
Section 5(c)
Prohibition on Targeting U.S. Citizens or Entities
This provision explicitly prohibits any person or entity receiving a cyber letter of marque and reprisal from knowingly conducting any operations relating to such letter against any United States citizen or entity.
Section 5(e), (f)
Funding Mechanism and Bounty Program for Recovered Assets
The President may require up to 15% of the total assets recovered by each letter holder to be forfeited to the United States. These funds are intended to sustain a bounty program for future cyber letter of marque and reprisal operations. The President is authorized to establish bounties for letter holders. Additionally, persons without a letter can receive up to 5% of recovered assets as a reward for providing information leading to such recovery. Any remaining recovered funds are to be deposited into the Crime Victims Fund.
This section states that if Congress authorizes traditional letters of marque and reprisal for activities at sea, on land, in air, or in space, then holders of cyber letters of marque and reprisal would also be authorized to conduct operations in those physical domains, to the extent permitted by the President.
Section 6
Why it matters:This appears to be standard legislative practice for anticipating future related legislation and ensuring consistency, rather than an attempt to obscure. It sets up a potential expansion of authority for cyber privateers into traditional warfare domains.
Case for: Proponents would argue that this provision ensures consistency and flexibility, allowing cyber privateers to operate across domains if the broader legal framework for traditional letters of marque is established, recognizing the interconnectedness of cyber and physical operations in modern conflict.
Case against: Opponents might argue that this conditional expansion of authority could lead to an overly broad and potentially dangerous delegation of military-like powers to private entities, without sufficient debate on the implications of private actors operating in traditional warfare domains, which could have severe international ramifications.
Estimated impact: Low immediate impact as it is conditional on future legislation, but potentially high future impact by expanding privateer authority beyond cyberspace into physical domains, significantly altering the scope of their potential actions.