Cyber Letters of Marque and Reprisal Act

(a) Short title.— This Act may be cited as the “Cyber Letters of Marque and Reprisal Act”.

(b) Table of contents.— The table of contents for this Act is as follows:

Congress finds the following:

(1) Clause 11 of section 8 of article I of the Constitution of the United States grants Congress—

(A) the power to “grant Letters of Marque and Reprisal” to punish, deter, and prevent acts of aggression and depredation and other malign acts committed by foreigners against Americans through cyber-enabled means; and

(B) the authority to make “Rules concerning Captures on Land and Water”.

(2) Digital assets have become a core component of the global financial system and are used daily by millions of Americans for payments, savings, remittances, and commerce.

(3) Americans are losing billions of dollars annually to crypto-enabled scams, fraud, ransomware, hacking, and theft. Seniors and other vulnerable populations are disproportionately harmed, with many victims losing life savings through schemes that exploit the speed, scale, and cross-border nature of digital assets.

(4) Cybercriminal organizations, transnational criminal networks, and state-aligned actors increasingly rely on digital assets to steal, launder, and move funds at global scale, financing ransomware attacks, sanctions evasion, weapons proliferation, terrorism, and other threats to United States national security.

(5) Digital asset financial crime is unfolding at machine speed. Funds can be stolen, laundered, and cashed out globally within hours, far outpacing traditional compliance and enforcement frameworks.

The purposes of this Act are—

(1) to authorize the President to issue cyber letters of marque and reprisal to commission private persons and entities to conduct limited cyberspace operations;

(2) to deter and disrupt real-world and cyber command and control structures and cyber operations against the United States, entities within the United States, or persons within the United States;

(3) to deter and disrupt cyberthreats, provide for compensation for successful private action modeled upon historic privateering on the high seas, and modernize such ancient tactics to deter modern threats;

(4) to facilitate the return of stolen funds to American victims of cyber-enabled crime; and

(5) to empower the private sector to protect victims, disrupt illicit networks in real time, and ensure that lawful digital asset innovation can continue to grow safely.

In this Act:

(1) Cyber letter of marque and reprisal.— The term cyber letter of marque and reprisal means a Federal commission authorizing a private entity to conduct specified cyber operations against designated targets in accordance with the conditions and restrictions imposed by the President pursuant to section 7.

(2) Cyber operation.— The term cyber operation means actions conducted in cyberspace, including—

(A) cyber exploration, including intelligence collection;

(B) data recovery;

(C) information operations;

(D) asset seizure (including digital assets and cryptocurrency);

(E) disruption of malicious infrastructure;

(F) actions in support of government operations or other entities operating under a letter of marque;

(G) combating cybercrimes; and

(H) other proactive actions intended to disrupt, degrade, deny, or destroy information systems or networks belonging or affiliated with designated cyberthreats.

(3) Cybercrime.— The term cybercrime includes any offense described in section 1028, 1028A, 1029, 1030, or 1343 of title 18, United States Code.

(4) Designated cyberthreat.— The term designated cyberthreat means a foreign individual, group, or entity identified by the President as—

(A) responsible for, or a sponsor of, cyberattacks against United States persons or assets owned or controlled by United States persons; and

(B) listed in a public registry in accordance with applicable law.

(a) Authority of the President.— The President, or a senior official designated by the President in accordance with section 301 of title 3, United States Code, is authorized to commission, under officially issued letters of marque and reprisal, as many privately equipped persons and entities as the President determines may be required, with suitable instructions to such persons or to the leaders of such entities to employ all means reasonably necessary to conduct cyber operations to disrupt, degrade, seize, and repatriate the assets, property, or infrastructure located outside of the geographic boundaries of the United States and its territories, of a designated cyberthreat.

(b) Security bonds.—

(1) Requirement.— The President may not issue a letter of marque and reprisal without requiring the recipient to post a security bond in an amount the President determines to be sufficient to ensure the execution of such letter in accordance with its terms and conditions.

(2) Forfeiture.— If the recipient of a letter of marque and reprisal violates the terms of such letter, the recipient shall forfeit part or all of the posted bond, in accordance with the terms of such letter.

(c) Restriction.— Any person or entity receiving a cyber letter of marque and reprisal may not knowingly conduct any operations relating to such letter against any United States citizen or entity.

(d) Recordkeeping requirement.— Any person or entity receiving a cyber letter of marque or reprisal shall keep a log of all activities conducted and assets seized pursuant to such letter for a period of not less than 5 years.

(e) Recovered assets.— In issuing cyber letters of marque and reprisal, the President may require up to 15 percent of the total assets recovered by each holder of a cyber letter be forfeited to the United States to fund a bounty program to sustain future cyber letter of marque and reprisal operations.

(f) Bounties.—

(1) In general.— The President is authorized to use funds recovered through cyber operations to establish bounties claimable by holders of cyber letters of marque and reprisal.

(2) Assistance.— A person or entity without a cyber letter of marque and reprisal may recover up to 5 percent of the total assets recovered from a designated cyberthreat as a reward for providing information leading to such recovery.

(3) Disposition of funds.— Any funds recovered through cyber operations that are not expended pursuant to paragraph (1) or (2) shall be deposited into the Crime Victims Fund established under section 1402 of the Victims of Crime Act (34 U.S.C. 20101).

(g) Limited offensive operations.— Holders of cyber letters of marque and reprisal are authorized to conduct limited offensive cyber operations, including the use of malware and other offensive tools targeting digital infrastructure (including hardware and software to conduct cyber operations) to the extent necessary to carry out such cyber operations.

If Congress authorizes the use of traditional letters of marque and reprisal for activities at sea, on land, in air, or in space, a holder of a cyber letter of marque and reprisal shall be authorized to conduct operations at sea, on land, in air, or in space to the extent permitted by the President under section 7.

The President, to the extent reasonably necessary, may issue guidance for—

(1) the requirements and qualifications required to receive a cyber letter of marque and reprisal under section 5; and

(2) the extent to which a holder of a cyber letter of marque and reprisal may conduct operations at sea, on land, in air, or in space pursuant to section 6.

No cause of action shall lie or be maintained in any court against the holder of a letter of marque and reprisal for any act of such holder that is expressly authorized by such letter.