S. 5000 — Cyber Letters of Marque and Reprisal Act

This section provides the short title of the Act as the Cyber Letters of Marque and Reprisal Act and sets forth the table of contents.

This section states congressional findings on the constitutional authority to grant letters of marque and reprisal to address cyber-enabled threats, the role of digital assets in the financial system, annual losses of billions of dollars to crypto-enabled scams and theft, and the use of digital assets by criminal and state actors to finance ransomware, sanctions evasion, and other national security threats.

This section states the purposes of the Act, including authorizing the President to issue cyber letters of marque and reprisal to private persons and entities for limited cyberspace operations; deterring and disrupting cyber command and control structures and operations against the United States; compensating successful private actions modeled on historic privateering; facilitating the return of stolen funds to American victims of cyber-enabled crime; and empowering the private sector to protect victims and disrupt illicit networks in real time.

This section establishes definitions for the Act, including a cyber letter of marque and reprisal as a Federal commission authorizing private entities to conduct specified cyber operations against designated targets. It also defines cyber operation to encompass intelligence collection, data recovery, information operations, asset seizure, disruption of malicious infrastructure, and other actions against cyberthreats; cybercrime by reference to specified offenses under title 18; and designated cyberthreat as a foreign individual, group, or entity identified by the President.

This section authorizes the President to issue letters of marque and reprisal to private persons and entities for cyber operations that disrupt, degrade, seize, and repatriate assets of designated cyberthreats located outside the United States. It requires security bonds subject to forfeiture for violations, bars operations against U.S. persons, mandates five-year recordkeeping of activities and seizures, permits the President to claim up to 15 percent of recovered assets for a bounty program, allows rewards of up to 5 percent for non-holders providing information, deposits unexpended funds into the Crime Victims Fund, and authorizes limited offensive operations including malware use.

This section authorizes holders of cyber letters of marque and reprisal to conduct operations at sea, on land, in air, or in space if Congress authorizes traditional letters of marque and reprisal for those domains, subject to limits set by the President under section 7.

This section authorizes the President to issue guidance on the requirements and qualifications for receiving a cyber letter of marque and reprisal, and on the permissible scope of operations by holders of such letters at sea, on land, in air, or in space.