Sponsor
Mike Lee
Senator · R-UT
Senator · R-UT
Authorizes the President to commission private actors via "cyber letters of marque" to conduct offensive cyber operations, seize digital assets, fund bounties, and bars civil suits for authorized acts.
Official title: Authorize the President of the United States to issue cyber letters of marque and reprisal, and for other purposes.
Introduced July 15, 2026 by Mike Lee · Last progress July 15, 2026
The bill trades broader, faster private-sector tools to disrupt cyber threats and recover digital assets (boosting national security and victim recovery) for increased risks to privacy, accountability, escalation and concentrated executive power that could reduce legal remedies and provoke diplomatic fallout.
Millions of Americans (taxpayers, businesses, and infrastructure users) could see stronger, faster protection from foreign and crypto-enabled cybercrime because the bill authorizes vetted private actors to disrupt attacks and recover assets.
Victims of cyber theft (individuals, small businesses, and institutions) could get improved recovery of stolen digital assets and return of funds, including routing recoveries to victims and the Crime Victims Fund.
Private-sector investment in cyber defense and rapid-response capacity is likely to increase because the bill creates pay-for-success compensation, bounties and a funding stream to incentivize recoveries and actions against threats.
American civilians, businesses and critical infrastructure face heightened risk of escalation or retaliatory cyberattacks and international diplomatic fallout because the bill authorizes offensive private operations that can cross borders and domains.
People harmed by authorized actions (including foreigners and some U.S. victims) may be barred from suing perpetrators, removing civil remedies and reducing accountability for wrongful harm.
Delegating offensive cyber authority to private actors and using broad definitions of 'cyber operation' increases surveillance and privacy risks for everyday Americans because private actors may access or manipulate data with limited judicial oversight.
Based on analysis of 7 sections of legislative text.
Authorizes the President to issue federal "cyber letters of marque and reprisal" that commission private persons or entities to carry out limited offensive and asset-recovery cyber operations against foreign-designated cyber threats. The bill sets definitions, requires security bonds and recordkeeping, allows limited seizures and retention of recovered digital assets (with a portion potentially used for bounties and victims' compensation), and bars civil suits for acts expressly authorized by a letter. The measure also permits those cyber letters to be extended into physical domains (sea, land, air, space) if Congress authorizes traditional letters of marque, and gives the President authority to issue implementing guidance on qualifications, scope, and safeguards. It creates criminal- and civil-liability protections for letter holders for authorized acts and establishes forfeiture, reward, and victims-fund routing rules for recovered assets.