Issuance of letters of marque and reprisal

(a) Authority of the President The President, or a senior official designated by the President in accordance with section 301 of title 3, United States Code, is authorized to commission, under officially issued letters of marque and reprisal, as many privately equipped persons and entities as the President determines may be required, with suitable instructions to such persons or to the leaders of such entities to employ all means reasonably necessary to conduct cyber operations to disrupt, degrade, seize, and repatriate the assets, property, or infrastructure located outside of the geographic boundaries of the United States and its territories, of a designated cyberthreat. (b) Security bonds (1) Requirement The President may not issue a letter of marque and reprisal without requiring the recipient to post a security bond in an amount the President determines to be sufficient to ensure the execution of such letter in accordance with its terms and conditions. (2) Forfeiture If the recipient of a letter of marque and reprisal violates the terms of such letter, the recipient shall forfeit part or all of the posted bond, in accordance with the terms of such letter. (c) Restriction Any person or entity receiving a cyber letter of marque and reprisal may not knowingly conduct any operations relating to such letter against any United States citizen or entity. (d) Recordkeeping requirement Any person or entity receiving a cyber letter of marque or reprisal shall keep a log of all activities conducted and assets seized pursuant to such letter for a period of not less than 5 years. (e) Recovered assets In issuing cyber letters of marque and reprisal, the President may require up to 15 percent of the total assets recovered by each holder of a cyber letter be forfeited to the United States to fund a bounty program to sustain future cyber letter of marque and reprisal operations. (f) Bounties (1) In general The President is authorized to use funds recovered through cyber operations to establish bounties claimable by holders of cyber letters of marque and reprisal. (2) Assistance A person or entity without a cyber letter of marque and reprisal may recover up to 5 percent of the total assets recovered from a designated cyberthreat as a reward for providing information leading to such recovery. (3) Disposition of funds Any funds recovered through cyber operations that are not expended pursuant to paragraph (1) or (2) shall be deposited into the Crime Victims Fund established under section 1402 of the Victims of Crime Act (34 U.S.C. 20101). (g) Limited offensive operations Holders of cyber letters of marque and reprisal are authorized to conduct limited offensive cyber operations, including the use of malware and other offensive tools targeting digital infrastructure (including hardware and software to conduct cyber operations) to the extent necessary to carry out such cyber operations.