(a) Short title

This Act may be cited as the Cyber Letters of Marque and Reprisal Act.

(b) Table of contents

The table of contents for this Act is as follows:

(1)

Clause 11 of section 8 of article I of the Constitution of the United States grants Congress—

(2)

Digital assets have become a core component of the global financial system and are used daily by millions of Americans for payments, savings, remittances, and commerce.

(3)

Americans are losing billions of dollars annually to crypto-enabled scams, fraud, ransomware, hacking, and theft. Seniors and other vulnerable populations are disproportionately harmed, with many victims losing life savings through schemes that exploit the speed, scale, and cross-border nature of digital assets.

(4)

Cybercriminal organizations, transnational criminal networks, and state-aligned actors increasingly rely on digital assets to steal, launder, and move funds at global scale, financing ransomware attacks, sanctions evasion, weapons proliferation, terrorism, and other threats to United States national security.

(5)

Digital asset financial crime is unfolding at machine speed. Funds can be stolen, laundered, and cashed out globally within hours, far outpacing traditional compliance and enforcement frameworks.

(1)

to authorize the President to issue cyber letters of marque and reprisal to commission private persons and entities to conduct limited cyberspace operations;

(2)

to deter and disrupt real-world and cyber command and control structures and cyber operations against the United States, entities within the United States, or persons within the United States;

(3)

to deter and disrupt cyberthreats, provide for compensation for successful private action modeled upon historic privateering on the high seas, and modernize such ancient tactics to deter modern threats;

(4)

to facilitate the return of stolen funds to American victims of cyber-enabled crime; and

(5)

to empower the private sector to protect victims, disrupt illicit networks in real time, and ensure that lawful digital asset innovation can continue to grow safely.

(1) Cyber letter of marque and reprisal

The term cyber letter of marque and reprisal means a Federal commission authorizing a private entity to conduct specified cyber operations against designated targets in accordance with the conditions and restrictions imposed by the President pursuant to section 7.

(2) Cyber operation

The term cyber operation means actions conducted in cyberspace, including—

(3) Cybercrime

The term cybercrime includes any offense described in section 1028, 1028A, 1029, 1030, or 1343 of title 18, United States Code.

(4) Designated cyberthreat

The term designated cyberthreat means a foreign individual, group, or entity identified by the President as—

(a) Authority of the President

The President, or a senior official designated by the President in accordance with section 301 of title 3, United States Code, is authorized to commission, under officially issued letters of marque and reprisal, as many privately equipped persons and entities as the President determines may be required, with suitable instructions to such persons or to the leaders of such entities to employ all means reasonably necessary to conduct cyber operations to disrupt, degrade, seize, and repatriate the assets, property, or infrastructure located outside of the geographic boundaries of the United States and its territories, of a designated cyberthreat.

(b) Security bonds

(c) Restriction

Any person or entity receiving a cyber letter of marque and reprisal may not knowingly conduct any operations relating to such letter against any United States citizen or entity.

(d) Recordkeeping requirement

Any person or entity receiving a cyber letter of marque or reprisal shall keep a log of all activities conducted and assets seized pursuant to such letter for a period of not less than 5 years.

(e) Recovered assets

In issuing cyber letters of marque and reprisal, the President may require up to 15 percent of the total assets recovered by each holder of a cyber letter be forfeited to the United States to fund a bounty program to sustain future cyber letter of marque and reprisal operations.

(f) Bounties

(g) Limited offensive operations

Holders of cyber letters of marque and reprisal are authorized to conduct limited offensive cyber operations, including the use of malware and other offensive tools targeting digital infrastructure (including hardware and software to conduct cyber operations) to the extent necessary to carry out such cyber operations.

(1)

the requirements and qualifications required to receive a cyber letter of marque and reprisal under section 5; and

(2)

the extent to which a holder of a cyber letter of marque and reprisal may conduct operations at sea, on land, in air, or in space pursuant to section 6.