S-5000-119
Read twice and referred to the Committee on Foreign Relations.
Sponsored by Mike Lee (R-UT)
What it does
This bill would authorize the President to issue "cyber letters of marque and reprisal" — federal commissions licensing private individuals and companies to conduct offensive cyber operations against foreign-designated cyberthreats. Licensed operators could seize digital assets, deploy malware, disrupt infrastructure, and collect intelligence against targets outside U.S. borders. Recovered assets would be split among the private operators, a government bounty fund, and the federal Crime Victims Fund, with up to 15% returned to the government and the remainder available to compensate victims of cybercrime.
Who benefits
American victims of ransomware, crypto fraud, and cyber-enabled theft who could receive restitution from recovered assets. Private cybersecurity firms and contractors who could earn bounties and asset recovery fees. Seniors and other vulnerable populations identified in the bill as disproportionate victims of crypto-enabled scams. The Crime Victims Fund, which would receive a share of recovered assets. U.S. companies whose stolen intellectual property or funds might be recovered. Informants without a formal commission who could earn up to 5% of recovered assets for tips.
Who is hurt
Foreign governments and entities designated as cyberthreats, whose infrastructure and digital assets could be targeted. U.S. allies whose nationals or infrastructure could be caught in cross-border cyber operations. Internet infrastructure operators globally, who may face collateral disruption from private offensive cyber tools. U.S. diplomatic interests, if private operators trigger international incidents. Civil liberties and cybersecurity researchers who warn that authorizing private offensive hacking normalizes practices that could be turned against civilians. Competing cybersecurity firms that do not receive commissions and face a market distorted by government-backed operators.
Supporters argue
Supporters argue that cybercriminals and state-aligned actors steal billions from Americans annually at machine speed, far outpacing traditional law enforcement responses, and that the Constitution explicitly grants Congress the power to issue letters of marque and reprisal (Art. I, §8, cl. 11) — a tool that has never been formally repealed. They contend that commissioning vetted private operators with strict bond requirements, recordkeeping mandates, and liability for violations creates an accountable, scalable force multiplier that can recover stolen funds and deter future attacks in real time, while directing recovered assets directly to victims.
Opponents argue
Opponents argue that authorizing private entities to deploy malware and seize digital assets creates serious risks of escalation, collateral damage to neutral third-party infrastructure, and potential violations of international law — risks that historically led nations to abandon privateering via the 1856 Declaration of Paris. They contend that the bill's oversight mechanisms are weak: the President sets qualifications, issues commissions, and defines targets with minimal congressional check, and the liability shield in Section 8 could immunize operators from accountability for harmful mistakes, including attacks on misidentified targets or cascading infrastructure failures.
Constitutional context
Article I, §8, Clause 11 explicitly grants Congress the power to "grant Letters of Marque and Reprisal," making this bill's core mechanism textually grounded in the Constitution. However, the bill delegates broad discretion to the President to designate targets, set qualifications, and direct operations, raising separation-of-powers questions about whether Congress is impermissibly transferring its own enumerated power to the executive. The Fourth and Fifth Amendments may also be implicated if operations — even against foreign targets — touch U.S. persons or infrastructure, consistent with the digital surveillance concerns raised in Carpenter v. United States (2018).
Checks and balances
The executive branch gains significant new authority to commission, direct, and compensate private cyber operators; checks include congressional authorization of the program, bond forfeiture for violations, a public target registry requirement, and a prohibition on operations against U.S. persons, though no independent judicial or legislative review mechanism is specified for individual target designations or operational decisions.
Historical precedent
The United States issued traditional letters of marque and reprisal during the Revolutionary War and the War of 1812, licensing private ships to attack enemy vessels; the practice was largely abandoned internationally after the 1856 Declaration of Paris, which the U.S. never formally ratified but has generally observed.