Congress quietly authorizes private hacking—with immunity from lawsuits

What it does

This bill authorizes the President to issue 'cyber letters of marque and reprisal'—federal commissions that allow private companies and individuals to conduct hacking, data seizure, and cyberattacks against foreign targets designated by the President as cyberthreats. The private operators keep up to 85% of any stolen assets they recover, with 15% going to a federal bounty fund; they are shielded from all lawsuits for actions authorized by their letter. The stated purpose is to disrupt ransomware networks, recover stolen funds for crime victims, and deter state-sponsored cyberattacks.

Why we flagged it

The bill's operative mechanism is not crime prevention—existing law already criminalizes cybercrime. The mechanism is authorization of private offensive cyber operations with a liability shield and profit incentive. This is a privatization of state military/intelligence function (cyber warfare) dressed in a crime-victim-protection frame.

What the text implies

• Section 8 grants absolute immunity to private operators for 'any act expressly authorized by such letter'—no judicial review of whether an act was actually authorized, and no remedy for collateral damage to innocent third parties or U.S. persons harmed by operator error or scope creep.
• Section 5(g) permits 'limited offensive cyber operations, including the use of malware'—the term 'limited' is undefined and delegated entirely to presidential guidance (section 7), creating no statutory constraint on offensive tool deployment.
• Section 6 creates a reciprocal authorization: if Congress authorizes traditional letters of marque (sea/land/air/space), cyber-letter holders can conduct operations in those domains 'to the extent permitted by the President'—this potentially expands cyber-letter scope to kinetic operations without explicit congressional authorization.
• Section 5(e) permits the President to seize up to 15% of recovered assets for a 'bounty program'—no statutory limit on how those funds are used, no requirement for congressional appropriation, and no audit trail specified.
• The bill defines 'designated cyberthreat' as any foreign entity 'listed in a public registry in accordance with applicable law'—but does not specify what law, what process, or what standard of evidence; the President's designation is unreviewable and may be classified.

Section numbers refer to the bill text the analysis read — linked under Primary records below.

Who it affects

While the bill frames itself as protecting Americans from cybercrime, it creates a privatized, largely unaccountable cyber-warfare apparatus with minimal oversight. Private entities gain immunity from lawsuits and financial incentive to conduct offensive operations; citizens gain no new substantive protections—existing law already criminalizes cybercrime and ransomware. The bill's core mechanism (liability shield + profit motive) creates moral hazard: private operators may conduct operations bey

Who stands to gain

• private cybersecurity firms and contractors authorized to conduct operations
• digital asset recovery services and blockchain forensics companies
• private intelligence and cyber-operations firms

Named in the bill

President of the United States, private entities and persons (cyber-letter holders), designated cyberthreats (foreign individuals, groups, entities), Crime Victims Fund (18 U.S.C. § 1402), U.S. persons and entities (protected from operations)

Where it stands

• Jul 15, 2026 — Introduced · Congress.gov: “Introduced in Senate”
• Jul 15, 2026 — Referred to Senate Committee on Foreign Relations · Congress.gov: “Read twice and referred to the Committee on Foreign Relations”

Dates and quoted wording are Congress.gov's action record; the timeline shows status changes, not every procedural step.