Sponsor
Mike Lee
Senator · R-UT
Senator · R-UT
The bill aims to strengthen U.S. cyber defense and speed asset recovery by authorizing and incentivizing private actors to take offensive and recovery actions, trading increased operational flexibility and faster victim recovery for elevated privacy risks, concentrated executive power, reduced civil remedies, and heightened risks of escalation and abuse.
Millions of Americans and U.S. systems (taxpayers, federal agencies, businesses, and critical infrastructure) could face fewer successful foreign cyberattacks because the bill authorizes vetted private cyber actors to actively disrupt, recover, and deter foreign cyberthreats across cyber and other domains.
Victims of cyber-enabled theft (individuals, small businesses, and government victims) could get more stolen funds and relief because the bill expands tools and authority to seize or recover illicit digital assets and return them to victims and the Crime Victims Fund.
Private-sector cyber responders and contractors could be incentivized to invest in rapid-response capabilities because the bill authorizes compensation and a recovery-funded bounty/incentive structure (including up to a percentage of recoveries to fund future operations).
People harmed by actions authorized under the bill (including foreign civilians, third parties, or U.S. persons affected indirectly) could lose their ability to sue authorized actors in U.S. courts, removing a civil remedy and limiting accountability.
Authorizing private offensive cyber operations and cross-domain activity (including malware and operations across land, sea, air, space) creates substantial risk of unlawful or mistaken actions, escalation, and international incidents that could harm innocent third parties and U.S. infrastructure.
Delegating offensive cyber authority to private actors who may access or manipulate data increases privacy and surveillance risks for everyday people if oversight and judicial review are inadequate.
Based on analysis of 7 sections of legislative text.
Gives the President authority to issue "cyber letters of marque" allowing private entities to conduct offensive cyber operations and seize digital assets from designated foreign cyberthreats, with immunity from suit and funds routed to bounties and the Crime Victims Fund.
Official title: Authorize the President of the United States to issue cyber letters of marque and reprisal, and for other purposes.
Introduced July 15, 2026 by Mike Lee · Last progress July 15, 2026
Authorizes the President to issue "cyber letters of marque and reprisal" that commission private persons or entities to carry out specified offensive cyber operations outside U.S. territory against foreign-designated cyberthreats. The law permits seizure and repatriation of digital assets, requires bonds and recordkeeping, allows the government to take a portion of recovered assets to fund bounty/informant rewards and deposit remainder into the Crime Victims Fund, and bars civil lawsuits for acts expressly authorized by a letter.