Hitting the Cyber Marque: Issuing a Cyber Letter of Marque to Combat Digital Threats [Army Lawyer, The]

By Kessinger, Christopher M

Proquest LLC

I. Introduction

At any given time, millions upon millions of people connect to each other via cyberspace.1 While a convenient method for grandparents to view pictures of their grandchildren, the Internet is also an exceedingly effective vehicle by which to attack a state, a company, or an individual. These attacks occur with frightening frequency, over 1,000 per hour in Great Britain alone2; and Britain recognizes the severity of the cyber threat.3 In the first four days of the November 2012 fighting between Israel and Gaza militants, over 44 million attacks on Israeli websites4 and an estimated 100 million total attacks occurred.5 Cyber- attacks cost Australia "an average of $2 million per incident" and exceed a billion dollars per year.6 Successful attacks also occur against international bodies, such as the International Atomic Energy Agency.7 These cyber attacks seek not only military targets, but also industrial espionage.8

Despite the frequency and increasing severity of cyber attacks,9 many governments and industries around the world, to include the United States, are either seemingly helpless against the cyber onslaught,10 too dysfunctional11 to create a useful offensive or defensive cyber scheme,12 or are "highly immature with limited vision and strategic foresight."13 Some foreign jurisdictions, our allies14 in the fight against cyber-attacks, fail to stem the tide of these attacks and now punish the cyber victims.15

This article explores the improbable, if not politically impossible, application of the letter of marque concept to the cyber arena. Despite the likely political stigma such a proposition would have in today's Congress, letters of marque are nevertheless a constitutional and valid tool to execute cyber operations, and thus worthy of discussion.

Proposed defenses to cyber attacks are becoming increasingly complex and bizarre.16 However, one historically effective and constitutional17 method of conducting both offensive and defensive operations has yet to be applied in a cyber context: the letter of marque.

This is a method of cyber self-help in which,

[i]n the context of privately conducted cyber attacks, letters or licensing could be used to specify the circumstances under which threat neutralization may be performed for the defense of property, the criteria needed to identify the attacking party with sufficiently high confidence, the evidence needed to make the determination that any given cyber attack posed a threat sufficiently severe as to warrant neutralization, and the nature and extent of cyber attacks conducted to effect threat neutralization.18

At its core, the letter of marque serves both military and law enforcement functions. Militarily, the government retains control over the letter of marque holder (a "privateer") and responsibilities as delineated within the express terms of the letter of marque while at the same time broadening the military's reach.19 As a law enforcement tool, a letter of marque deputizes an individual or company, thus vesting that entity with police powers. This authority allows the privateer to detain targets, bring them before the sovereign, and receive compensation based on successes, much like a bounty hunter.20 Using civilian forces in a military/national defense context is not a concept limited to antiquity. For example, monitored non-governmental civilian participation in governmental operations exists with private military contractors. The United States spent over $300 billion on military contractors from 2001-2007.21

There is an apparent aversion to the use of letter of marque and privateers.22 Various bills introduced throughout the years proposing the revival of letter of marque have stalled or failed outright.23 Despite the hesitation, letters of marque and privateers served a legitimate military purpose,24 both in supplementing regular combat forces and crippling enemy commerce while protecting American commerce.25 A cyber letter of marque would enable a privateer to seize digital assets, disrupt fiscal and communication networks, destroy attacking networks,26 and act as a cyber bounty hunter.

Applying a letter of marque scheme to the cyber world would not only provide authority for American companies to defend themselves from cyber threats, but also allow them to take proactive measures to neutralize a cyber threat before it coalesces into danger. In addition to providing requisite authorization, a letter of marque scheme would regulate the conduct of a prospective cyber privateer and ensure accountability to effect compliance with the letter of marque's mandate.

Part II of this article examines the historical usage of letters of marque and privateers. A brief historical discussion shows the use of letters of marque in national defense. Such historical perspective provides a useful background when considering their application to cyberspace. Part III applies legal and historical principles to a modern letter of marque regime. In particular, the application of letters of marque within the context of existing technologies and proposed authorization and oversight safeguards are examined. The various laws implicated in a modern cyber letter of marque regime are reviewed in Part IV. Finally, Part V addresses the authorizations and oversight necessary to effectively manage a successful, and lawful, cyber letter of marque regime. While not meant to be an exhaustive analysis of all possible facets related to the implementation of a cyber letter of marque regime, this article shows that despite some initial political and legal issues, using a cyber letter of marque can effectively mitigate the threats posed by cyber attacks.

II. History of Letter of Marque and Privateering

The concept of allowing private individuals to wage war on a foreign sovereign is not new, nor is it unique to United States history. The letter of marque27 and privateering concepts have been a part of both international law and the accepted norms of warfare for centuries,28 despite the Declaration of Paris-which purportedly banned privateering.29 Hugo Grotius, considered by many to be the father of the modern Law of Armed Conflict, noted that letters of marque and reprisal are endorsed by the entirety of the law of nations.30 Historians credit the expansion and development of the Western world from 1600 to 1815 to privateers.31

The letter of marque originally served as a "self-help" authorization, allowing a private individual to seek reprisal against a foreigner who caused him harm.32 Over time, this developed into a government's authorization to act on its behalf and seize property belonging to an enemy government, usually in the form of ships and cargo.33 In its most fundamental form, a letter or marque authorized private merchant ships to carry arms in self-defense.34

Upon its founding, due to its small navy,35 not only did the United States employ letters of marque, but it also was "the world's biggest proponent of privateering."36 The Continental Congress issued many letters of marque,37 as did individual states.38 In fact, John Adams reportedly called an early letter of marque scheme, the Massachusetts Armed Vessels Act, "one of the most important documents of the Revolution."39

Thomas Jefferson was also an ardent proponent of privateering: "every possible encouragement should be given to privateering in time of war. . . . Our national ships are too few . . . to . . . retaliate the [sic] acts of the enemy. But by licensing private armed vessels, the whole naval force of the nation is truly brought to bear on the foe."40 Jefferson also realized that letters of marque served more than an offensive purpose, detailing how they are also a means of self-defense:

The ship Jane is an English merchant vessel . . . employed in the commerce between Jamaica and these States. She brought here a cargo of produce . . . and was to take away . . . flour. Knowing of the war when she left Jamaica, and that our coast was lined with small French privateers, she armed for her defense [sic], and took one of those commissions usually called letters of marque. She arrived here safely . . . . Can it be necessary to say that a merchant vessel is not a privateer? That though she has arms to defend herself in time of war, in the course of her regular commerce, this no more makes her a privateer, than a husbandman following his plough in time of war, with a knife or pistol in his pocket, is thereby made a soldier. The occupation of a privateer is attack and plunder, that of a merchant

vessel is commerce and self- preservation.41

Support for letters of marque by the founding fathers was not merely philosophical consent. Thomas Paine and George Washington both owned stock in privateering ventures.42 Additionally, Benjamin Franklin practically ran his own privateering operation while he was assigned to France.43 While most privateering ventures were for money, Franklin used the captured British ships, goods and men to trade for American prisoners of war.44

Privateering in general weakened an enemy's economy and its ability to wage war.45 The American privateers devastated British commerce, funding the first two years of the war substantially through British captures.46 By early 1777, the British had lost 250 ships, resulting in the collapse of several major London-based West India merchant companies.47 Within a year, American privateers captured 559 British ships.48 Of the approximately 796 British ships captured during the Revolutionary War, American privateers and armed merchant ships accounted for roughly 600.49 British merchants, feeling the crippling effect of American privateers,50 ensured that "every pressure was brought to bear on Parliament for [the Revolutionary War's] discontinuance."51 Even ships carrying linen from England to Ireland feared the American privateers, to the point of demanding warship escorts.52

At the outset of the War of 1812, the British Navy consisted of 1,060 warships. In contrast, the United States Navy had only sixteen, including several that were unfit for sea.53 As a consequence, the United States Navy was not considered to be a serious threat to British naval superiority.54 In response, Congress passed a statute authorizing the use of privateers, but tightly controlled them.55 The President could revoke, "at pleasure," any letters of marque he issued after June 1812. The applicant had to list specific details about the ship, crew, and owners, and "Ample security" submitted to ensure compliance with both international and United States law. Further, and perhaps most relevant to modern application, the ship commanders were required to keep a detailed log of everything "that occurs, daily, and transmit them to the government," and regular United States Navy commanders had to examine these logbooks when "meeting the privateer at sea."56 Failure to abide by these rules would mean forfeiture of the bond and "of all interest in any captures which they may make."57

With this new authorization in hand, American privateers wreaked havoc on British shipping and secured victory in America's second war for independence.58 In the process, privateers tallied $39 million in prizes, or roughly $672.5 million in 2012 dollars.59

Following the War of 1812, letters of marque did not disappear from the American landscape. President Andrew Jackson, in 1834, discussed the use of letters of marque against France.60 Texas, upon declaring independence from Mexico, realized its coast was vulnerable due to a nascent navy. In response, the fledgling Texas legislature began to issue letters of marque with the intent to "protect the coast, harass Mexican shipping, and bring prizes that could be auctioned off, with part of the proceeds going to the public treasury. In all, Texas issued six letters of marque.61 Similarly, President Polk recognized the lawful ability of Mexico to issue letters of marque during the Mexican American War.62

In 1856, Britain, France and other titular world powers met in Paris to discuss concerns arising from wartime maritime law.63 France and Great Britain sought to end privateering as they could not effectively control the use of privateers by their enemies, i.e., the United States and Russia.64 Great Britain, in particular, recognized privateering as an effective tool of weaker navies that posed a threat to its naval supremacy and sought to contain it.65 The result of this meeting was the Paris Declaration of 1856, a document attempting to ban privateering.66

The Paris Declaration contained three major provisions:67 the first provided that "[p]rivateering is, and remains, abolished;" the second prevented the seizing of enemy goods on neutral ships; and the third prevented capture of neutral goods on enemy ships.68 Most importantly, the Declaration went to great pains to ensure that its provisions did not apply to any nation save signatories.69 This provision is important for two reasons.

First, it made clear that it was not intended to be a universal ban on privateering, as it only applied to signatory nations at war with other signatories.70 Second, as stated in the document, it did not have the power to police the actions of non-signatories.71

The United States recognized that this agreement was merely a means for England to maintain maritime supremacy at the expense of nations with a smaller seafaring force, and accordingly, demanded conditions prior to capitulation.72 The United States agreed to acquiesce and sign the document only if protection of all non-contraband private property from capture at sea was included.73 The United States reasoned that since all private property is protected on land, "why should it not be [protected] also on the sea?"74

While the United States wanted to ensure it would be allowed to trade with both sides of a conflict, free from privateer entanglements, another more vital concern existed. According to Secretary of State William L. Marcy, "the United States could not forgo the right to send out privateers, which in the past had proved her most effective maritime weapon in time of war, and which, since she had no large navy, were essential to her fighting power."75 The United States realized that if privateering was banned, its nascent navy76 would be no match for the greater naval might of countries such as Britain and France.77 As the plenipotentiaries who signed the Declaration would not adequately address American concerns regarding private goods, and factoring in Marcy's concern about the resulting unequal balance of naval power, the United States refused to sign the agreement.78

The issue of privateering arose again in April 1861 when Confederate President Jefferson Davis, with Confederate Congressional approval,79 issued letters of marque against Northern shipping.80 In accordance with this authorization, the South immediately sought to hire British and French privateers. Perhaps fearing the involvement of the British or French navies in the conflict, the Union declared that it would follow the Declaration and not issue letters of marque and Secretary of State Seward instructed American ambassadors to determine whether the signatories would be amicable to incorporating the proposed changes advocated by Marcy, thus allowing the United States to formally sign the Declaration.81 As an indication of the Union's fear of privateers, Secretary Seward authorized acquiescence to the Declaration even if the requested exceptions were not approved.82 Britain and France declined the advances and the United States remained a non- signatory.83

Consequently, the Union passed a statutory authorization for President Lincoln to issue letters of marque84 and declared that all attempts to disrupt, capture or destroy Union shipping would be treated as piracy and dealt with as such.85 Regardless, the British entered the Civil War as privateers, sailing under letters of marque issued by the Confederacy. In fact, in a case brought by the United States against Britain for damages caused by a privateer, an international tribunal found no issue with a non-signatory (the Confederacy) issuing letters of marque to a signatory (Britain) "to construct, furnish, and crew ships to be used in commerce raids against a non-signatory, the United States."86

When the United States entered into conflict with the Spanish during the Spanish American War, neither the United States nor Spain was a signatory to the Declaration of Paris.87 Not only did Spain specifically reserve the right to issue letters of marque,88 the Spanish government recognized

America's right and ability to issue the same.89 The Spanish never carried out the threat, and President McKinley, for the first time, articulated a U.S. intention to comply with the Paris Declaration, though still not be a signatory.90

Despite the reluctance, both Spain and the United States found ways to unofficially authorize privateers without formally issuing letters of marque.91 Both nations organized "auxiliary cruisers of the Navy."92 The United States Navy chartered private merchant ships, heavily armed them, and subsequently entered into naval service.93 The Navy used the ships and manned them with the owner's regular, ostensibly civilian crew, placing the ships "under the entire control of the senior naval officer on board."94 One such ship, the City of Paris,95 actually took prizes, with the United States Prize Court holding that she was not a "'vessel of the Navy nor a privateer . . . '"96 and finally ruling that she was an "armed vessel in the service of the United States" and the civilian crew was "entitled as of right to share in the prize money."97

While the nature of privateering changed with the Spanish-American War, privateering did not disappear. At the 1907 Hague Peace Conference, the United States again voiced its opposition to the privateering prohibition.98 Specifically, the United States voiced the same concerns as it did during the original 1856 negotiations,99 that "the inviolability of unoffending private property belonging to the enemy on the high seas be guaranteed."100 Because other delegates gave no such guarantees, the United States, on two separate occasions, refused to acquiesce, proclaiming that "[i]t is well known that the Government of the United States of America has not adhered to that Declaration."101 The issue of privateering rested with this last American objection102 until Congress drafted several bills calling for their reemergence.103

III. Applying Letters of Marque to Cyber Warfare

Letters of marque were the original "self-help" governmental authorization.104 While used to great effect in the past, they can now be resurrected and used to achieve similar results, especially in a cyber context. This section addresses the use of a cyber letter of marque in three areas: seizing assets; disrupting, disabling, and dismantling adversarial networks; and conducting cyber bounty hunting and rewards programs.

A. Seizing Assets

In a modern cyber letter of marque scheme, the U.S. government would authorize certain companies or individuals to track, freeze, and seize the illicit funds of designated criminal organizations. The net effect would be cutting off supplies to deliver the United States from its enemies.105 For example, the United States has recently named several Russians as "transnational criminals" and promulgated an Executive Order that authorizes "seizure of their assets in the United States and prevents them from banking in dollars anywhere in the world."106

When rogue states, such as Iran, contravene the will of the international community, the most used method of ensuring compliance is via the United Nations Security Council or unilateral economic sanctions.107 The United States first instituted sanctions against Iran in 1979, following the seizure of the American Embassy during the Iranian Revolution. These sanctions included freezing roughly $11 billion in Iranian assets.108 Iran continues to launder and hide money in contravention of these resolutions, often with the help of international banks.109 In just one instance, the illicit transactions totaled $250 billion.110 Iran has also turned to China, specifically its banking system, for help in escaping economic sanctions.111 Illicit money laundering in contravention of United Nations resolutions is not limited to Iran, but has also included North Korea, Cuba, Sudan, and Mexican criminal cartels.112

Money laundering is not exclusive to United Nations resolution violators; illegal activity also includes organized crime and tax evasion schemes.113 According to the United Nations Office on Drugs and Crime (UNODC), they report an estimated $1.6 trillion dollars in money laundering in 2009 alone.114 While U.S. law enforcement has had some success in prosecuting international banks with substantial United States ties,115 less than one per cent of illegal money is seized globally.116 Seventy per cent of these illicit funds are funneled through the international banking system.117 "[T]racking the flows of illicit funds generated by drug trafficking and organized crime and analyzing how they are laundered through the world's financial systems remain daunting tasks."118 When faced with this exorbitant number, the victories scored by the justice system seem hollow. A cyber letter of marque would allow a privateer to seek these illicit funds wherever they may be hidden and either seize them or digitally sequester them for further law enforcement action. Such a cyber letter of marque brings to bear a formidable resource that will increase the likelihood for seizure of illicit funds and the shutdown of avenues for illicit funding.

The idea of using a letter of marque to effect an economic result is not novel. John Adams, in singing the virtues of privateering, said "[I]t is by cutting off supplies, not by attacks, sieges, or assaults, that I expect deliverance from enemies."119 While letters of marque during the Revolutionary War and the War of 1812 had distinct military objectives, they were "also a means of commercial warfare conducted for profit."120 Privateers "were engaged not in patriotic, but business ventures."121 Some privateers amassed great fortunes through their letter of marque commissions,122 with even the common seaman receiving up to one thousand dollars above his regular wage from just one voyage.123 The proceeds from captured enemy goods, once sold via the Unites States Prize Courts, were split between the privateer and the sovereign, thus providing a much needed injection of funds to the government and the privateer, while at the same time depriving the enemy of resources.124

Motivated by the possibility of retaining a healthy percentage of the roughly $1.6 trillion presently illicitly laundered worldwide, the number of prospective cyber privateers would be legion. Consequently, the United States government would be in a position to demand an exorbitantly high bond, thus guaranteeing that only the most technically proficient and responsible cyber privateers would seek the commission. As for the cyber profiteer, the prospect of sharing a large percentage of the trillions of dollars, not to mention the potential for criminal or tort liability,125 would ensure strict compliance with the terms of the letter of marque. As the privateer in the 1700s and 1800s provided both a much needed governmental funding stream126 and served a valid national security function, so too would a modern cyber privateer by removing illicit funds from the hands of organized crime and sanction violators. The end result would be a potential death blow to crime organizations and rogue regimes.

Currently, the law restricts anyone from attempting to seize assets, whether they belong to the most deplorable rogue regime or the most vicious drug cartel. A cyber letter of marque would vest responsible and vetted entities with authority to digitally seize illicit funds while providing legal protections from criminal and/or civil liability. Current laws restricting attempted seizures would remain in place for those acting without a valid letter of marque or those operating outside the scope of their letter of marque commissions.

B. Disrupting, Disabling, and Dismantling Adversarial Networks

In December 2012, a cybercriminal known as "vorVzakone"127 announced Project Blitzkrieg, wherein he128 planned to attack 30 Unites States banks in an attempt to steal money from accounts belonging to the "rich."129 McAfee Labs, a leading computer security company,130 determined that this "is a credible threat to the financial industry and appears to be moving forward as planned."131 The projected losses from the announced attack could reach "hundreds of millions of dollars."132 The targets of the planned attack included Bank of America, Capitol One, Suntrust, Ameritrade, eTrade, and Fidelity and Schwab.133 From April to December 2012, vorVzakone claimed at least 500 cyber victims.134

At roughly the same time that the U.S. banking industry began to deal with vorVzakone, bank officials were contending with cyber attacks emanating from Iran.135 The attack's complexities are comparable to that of "a pack of fire-breathing Godzillas."136 In fact, the internet traffic used in the attacks has been '"multiple times" the number that Russia allegedly directed or encouraged at Estonia in a month-long online assault in 2007 that nearly crippled the Baltic nation.137 The attackers warned that they will not cease their attacks: "From now on, none of the United States banks will be safe."138 Iran denied all responsibility.139

To add to the growing threat from Russian criminals and rogue nations like Iran, North Korea is greatly expanding its cyber capabilities, enabling it to "disrupt and immobilize [i]nternet traffic and key computer systems."140 In fact, Lee Dong Hoon, with the Center for Information Security Technologies at the Korean University in Seoul, surmises that the North Koreans have been preparing their cyber forces since the 1980s and "may rank third worldwide in this field after Russia and the United States."141

Naturally, victimized United States banks are crying out for help from the federal government, while at the same time spending millions of dollars in an attempt to cease the attacks.142 Despite the aggressiveness, danger posed, and monetary cost, U.S. companies have received no more assistance than advice not to take any more aggressive defense measures than "contact[ing] the system administrator from the attacking computer to request assistance in stopping the attack or in determining its true point of origin."143 This purely defensive approach, obviously, has not worked, as "[t]he really good cyber hackers . . . are seldom stumped when trying to penetrate a network."144

While the U.S. government claims that "[a]ll options are on the table" with regard to responses to these attacks,145 the one option that has not been discussed is a cyber letter of marque. The current law, and seemingly political position, is basically forcing U.S. companies to "just stand and take a beating."146 Even if the U.S. government takes on a more proactive role in the cyber arena, it is widely accepted that U.S. law enforcement lacks the sufficient number of trained cyber police necessary to effectively engage the current and emerging cyber threats.147

While a lot of "private companies only have simple fire walls that can be overcome [if] the hacker is an expert,"148 some in the private sector claim to have the skill set required to confront this threat.149 These attacks continue because, in part, there is no disincentive for the bad actors, as they know nothing will happen to them.150 However, if the United States authorized tightly controlled offensive cyber capabilities via a congressionally authorized cyber letter of marque, the nation could allow a U.S. cyber entity to neutralize the attacker and their capabilities.151 As a direct consequence, the attacks will most likely cease and the attackers will move to easier targets.152 In essence, a cyber letter of marque would "arm" U.S. entities, thus allowing them to protect themselves in much the same way the historical letters of marque allowed merchant ships to arm themselves for self-defense purposes.153

As with seizure of assets, ample historical support exists for the use of privateering in the disruption of enemy activity. As discussed previously,154 American privateers disrupted English commerce to such an extent that several London-based firms went bankrupt.155 British merchants, their livelihoods so disrupted and, in fact, disabled, put pressure on their own government to end the war and allow the Americans to have their independence.156 The financial toll on the enemy during the War of 1812 by American privateers was staggering, which in turn had the operative effect of weakening both British naval superiority and morale in England. If privateering proved to be such an effective defensive weapon in a naval context, it can certainly be used in a cyber context where disrupting an enemy's attack can be done through a keyboard by a handful of individuals instead of through fourteen-gun warships manned by over a hundred crewmen.157

C. Cyber Bounty Hunting

The realm of cyber letters of marque is not limited to offensive or defensive actions in the classic sense. A cyber letter of marque could also be utilized as a method of bounty hunting, providing information to law enforcement agencies necessary to apprehend a cyber attacker.

Bounty hunting, like a letter of marque, is an activity intertwined with the history of the United States. The United States Supreme Court endorsed bounty hunting as a legal activity in the 1872 case Taylor v. Taintor.158 The federal government endorsed, and continues to endorse, bounty hunting for capture (as opposed to kill) as exemplified in the most wanted lists.159 Perhaps most famously, the United States issued a $25 million bounty for information leading to the arrest or capture of Osama Bin Laden.160 Even the U.S. Department of State endorses bounty hunting, offering rewards of up to $5 million for the capture of purported terrorists through their Rewards for Justice Program.161 The United States is not alone in harboring a vibrant bounty hunting industry. Iceland recently hired a financial bounty hunter to track down fugitive bankers.162

Individual American states adopted some form of the Uniform Criminal Extradition Act and passed laws163 governing the conduct of bounty hunters, bail recovery agents, or similarly named entities. Most states have statutes that detail their licensing requirements, the bounty hunter's arrest authority, and insurance requirements. For example, Virginia sets minimum requirements spanning age, education, citizenship and requisite hours of Bail Enforcement Agent training.164 Virginia also establishes criminal liability for operating as a bounty hunter without a valid license.165 Some states restrict "freelance" bounty hunting, allowing only those who actually hold a bond to affect captures,166 whereas some completely prohibit operation within their boundaries by bounty hunters from another state.167 Conversely, some states have no training or licensing requirements.168 Bounty hunting has become sufficiently "mainstream" in the United States that industry trade associations169 have been established, with ethical codes, bylaws, and boards of directors.

The situation changes if a U.S. company uses a computer to track down a hacker, acquire evidence of illegality sufficient to support an arrest, obtain information from his/her computer sufficient to accurately pin point the hackers' location and then provide that information to law enforcement. This, arguably, would be illegal under current United States law.170

The Computer Fraud and Abuse Act (CFAA) serves as a barrier to a corporation or individual171 from coming to the aid of a cyber-attack victim. Congress could carefully draft cyber letter of marquee legislation authorizing such entities to track and digitally "capture" a cyber criminal or terrorist. The only difference between the reward/bounty programs currently operated by the United States Government and a cyber letter of marque is the antiquated CFAA prohibition.

Indeed, other scholars have posited the use of bounty hunting letters of marque.172 For example, Robert P. DeWitte, writing in the Indiana Law Journal, discussed one of the potential downfalls between physical, as opposed to virtual, bounty hunting through the use of a letter of marque. In particular, he illuminated the legitimate concern that "state authorities could conceivably attempt to capture and/or kill privateers" in their territory while operating under a valid U.S. letter of marque.173 However, this concern in a cyber letter of marque context is not applicable since the cyber privateer/bounty hunter would be safely ensconced in the territorial United States, outside the physical reach of an unfriendly foreign armed force.

Just as letters of marque are constitutional,174 so too are bounties, as over a hundred years of U.S. jurisprudence demonstrates.175 The issuance of a cyber letter of marque does not have to have the "bounty hunter" moniker, as it is analogous to a whistleblower or qui tam176 suit whereby the privateer, minus the constraints of current domestic laws such as the CFAA, may gather information about an attacker or enemy and provide it to the proper authorities in return for monetary compensation. A cyber letter of marque would allow a cyber privateer access to those established and protected legal mechanisms.

IV. Legal Barriers

Despite the many potential applications of a cyber letter of marque, some arguments raise concerns about the legality of its application. When discussing letters of marque, most commentators cite to the same alleged legal barriers to implementation: domestic law, usually the CFAA; the Law of Armed Conflict, specifically attribution and self-defense concerns; the Paris Declaration of 1856; and the Council of Europe Convention on Cyber-crime. This section examines each of these areas and analyzes why they are not legal barriers to the implementation of a cyber letter of marque regime.

A. The Computer Fraud and Abuse Act

The Computer Fraud and Abuse Act,177 initially a criminal statute protecting government computers and those computers belonging to entities with compelling government interests,178 forces companies under attack to "just stand and take a beating."179 Since its passage in 1984, it has expanded180 to include civil liability by prohibiting anyone from "intentionally access[ing] a protected computer without authorization or exceed[ing] authorized access . . . [and recklessly causing damage181 involving a loss182 of] at least $5,000 in value."183 The definition of a "protected computer" has expanded to cover not only U.S. government computers, but also any computer "used in a manner that affects interstate or foreign commerce."184 Even those computers located outside the United States are protected.185 Potentially, every single computer connected to the internet anywhere in the world would be a "protected computer" pursuant to the CFAA,186 including, potentially, a blue- tooth-enabled garage door opener or coffeemaker in suburbia.187

While the CFAA prohibits the mere access to a protected computer, causing damage seems to be the lynchpin to triggering civil and criminal penalties under the CFAA. Some courts have homed in on the damage requirement, refusing to find civil or criminal liability. For example, in Moulton v. VC3,188 the court held that an unauthorized port scan and throughput test of a defendant's servers is not a violation of the CFAA189 since no "damage" was caused. Likewise, in United States v. Czubinski,190 the court reversed the criminal conviction of an IRS agent who accessed a "protected computer" to satisfy his curiosity.191

While some of the judicial decisions seem to allow some degree of cyber intelligence collection under the current regulatory scheme,192 the courts clearly would not allow an entity to seize assets, whether they are being laundered at a major international bank or if information leading to their location is on a drug kingpin's desktop computer. Consequently, government authorization would first be a necessity.193

Despite allowing for criminal and civil penalties, the CFAA is not an effective means of preventing cyber attacks.194 Some have argued that active-defense authorizations, such as a letter of marque, are not necessary as the cyber victim can turn over evidence of a cyber attack to the FBI for prosecution.195 While this might work in theory, in actual practice it leaves the cyber victim virtually remediless for a host of reasons. For one, law enforcement personnel are questionably competent when it comes to cyber attacks and cyber crime.196 Further, due to the global nature of cyber attacks, an American court might have a difficult time bringing a cyber attacker within its jurisdiction.197 Even if a cyber attack victim captures all the information necessary to conduct a thorough law enforcement investigation, the FBI has bungled such gift- wrapped cyber cases in the past.198

Just as cyber criminals are capable of seizing money from an individual's bank accounts,199 cyber companies with the technical expertise can track down and seize illicit funds, given the proper governmental authorization. A cyber letter of marque would provide such authorization.

B. Attribution and Self-Defense

Attribution is the legal requirement to positively identify the attacker prior to responding with force in self- defense.200 How does a prospective cyber privateer ensure it is striking the proper target201 and how does a cyber- privateer cover their tracks so as to not entice further attacks? Admittedly, discovering the source of a cyber attack is "the most important aspect of active defense." 202 It necessarily must be a requirement when issuing a cyber letter of marque to ensure that the privateer is targeting the proper bad actor. Critics have complained that it is too difficult to identify the attacker with sufficient accuracy to ensure a counter-attack is accurately aimed.203 While tracing an attack may not provide actionable results, and some technologies "limit the ability to make perfect surgical strikes with active defense,"204 the problem may not be as big as it appears. Some speculate that it is more difficult for the bad actor to identify the cyber privateer than it is for the cyber privateer to identify the bad actor.205

The attribution concerns may, however, be a bit over- blown.206 Even the Russian cyber attacks launched or encouraged against Estonia could be traced back to the "Russian intelligence apparatus."207 In fact, "attribution to at least some level will almost always be possible."208 While the exact technologies available to ensure accurate attribution, which can be done in seconds, are not the focus of this paper, such technology is not new and "is currently the subject of a significant amount of research aimed at improving accuracy and efficiency."209 While it may not be feasible, or even possible, to accurately attribute 100 million cyber attacks,210 "it is clear that the current state of the technology is adequately advanced to permit the discussion of active defense to move forward into an evaluation of how an active defense scheme should be implemented."211

C. Paris Declaration of 1856

Most critics of the letter of marque, regardless of its application, usually point to the Paris Declaration of 1856, noting that the United States is prohibited from employing privateers due to the agreement.212 This argument, however, is without merit.

First, the Declaration does not apply to the United States per the plain language of the treaty. "The present Declaration is not and shall not be binding, except between those Powers who have acceded, or shall accede, to it."213 The United States did not accede to it in 1856 and has not, in the ensuing 157 years, acceded to it. Under the rules of treaty interpretation,214 a treaty is binding only upon parties to it,215 and it "does not create either obligations or rights for a third State without its consent."216 Further, in order to impose an obligation on a third State, it must "expressly accept that obligation in writing."217 To date, the United States has not consented to the obligations of the Declaration in writing, as required by the Vienna Convention on the Law of Treaties.

Additionally, the Declaration clearly pertains, and limits itself, to maritime law.218 Since a cyber letter of marque regime is not grounded in maritime law and letters of marque are specifically authorized in the United States Constitution, it is permissible under international law, Paris Declaration notwithstanding, to issue cyber letters of marque.

Others argue219 that the Declaration has become customary international law.220 While this might be true at first blush, it ignores the legal and historical fact. A nation, not otherwise bound by a treaty, does not become bound by operation of the rule of customary international law if it has been a persistent objector. In order to be considered a persistent objector, and therefore not bound by a treaty, the State "must have objected to the emergence of a new norm during its formation and continue to object afterwards."221 Even if it has been state practice to follow the precepts in a treaty, non-signatory states can alter their actions in order to confront new threats.222

Regarding the Declaration of Paris, the United States objected during the formation of the proposed privateering ban223 and objected to the Declaration by passing legislation authorizing privateers during the Civil War;224 the Spanish government recognized America's right to issue letters of marque during the Spanish-American War,225 and voiced opposition at the 1907 Hague Peace Conference.226 Clearly, the United States has been a persistent objector to the Declaration and thus not bound by it. Simply stated, American privateering declined not because of acquiescence to international treaties which it did not, and had no intent to, sign. Rather, privateering declined because America, after 1898, no longer had a nascent navy, had become a major naval power,227 and the "cost-saving advantages of privateering [had] declined."228

Assuming, arguendo, that the Paris Declaration is customary international law that the United States must follow, the issuance of cyber letters of marque is still not banned. The Declaration never defines privateers.229 As history demonstrates, a contracted civilian ship can be armed, staffed with civilians, fight, and take prizes-all without violating the Declaration. 230

D. The Council of Europe Convention on Cyber-Crime231

On 23 November 2001, the United States signed on to the Council of Europe Convention on Cybercrime.232 The Cybercrime Convention came into effect in the United States on 1 January 2007.233 The Cybercrime Convention's main objective "is to pursue a common criminal policy aimed at the protection of society against cyber-crime, especially by adopting appropriate legislation and fostering international co-operation."234 It purports to allow countries to work together through substantive, procedural, and jurisdictional laws against a cyber criminal committing crimes in one country while physically located in another.235 Prior to the Cybercrime Convention (and some would argue even today),236 the cyber police forces in the United States or internationally did not have the tools or authority necessary to combat cyber-attacks. Additionally, it did not address the cultural issues that may arise from crimes committed in cyberspace.237 To make matters worse, some countries did not have adequate laws against cyber-crime.238

An attempt to correct these law enforcement deficiencies was the impetus for the creation of the Cybercrime Convention. It remains the only international treaty attempting to deal with the issue of transcontinental cyber attacks.239 It fails, however, to effectively protect anyone from cyber attacks. It is largely a symbolic document, serving mainly to reassure the public that governments are doing something to address the threat.240 Those reassurances are hollow, as only roughly half of the ratifying states have passed domestic legislation required to enforce the document.241

Remarkably, the exceptions contained in the Cybercrime Convention negate its impact. First, no requirement exists that any cyber attacker actually be prosecuted; instead, the State must merely "report the final outcome to the requesting Party [i.e., the cyber victim's nation] in due course."242 In addition, nearly every enforcement provision of the Cybercrime Convention contains a legislative flaw, allowing a nation state to refuse to cooperate.243 A nation may refuse a request for assistance during or after a cyber attack emanating from its country for a host of reasons. These reasons include, but are not limited to244: if a request for assistance would violate domestic laws,245 if a request for assistance and information gained therefrom could be used in any investigation or court proceedings other than those listed in the request,246 or if an attacked nation believes there are political issues at play. 247

Perhaps as a sign of the naïve belief that the feckless Cybercrime Convention will actually curb cyber attacks, the Council of Europe'sCommittee of Experts on Terrorism opined in February 2010 that no further conventions are needed to address cyber terrorism because "large scale attacks on computer systems appeared to be already covered by the Cybercrime Convention."248 Yet two days later, on 18 February 2010, The Washington Post broke the story that more than 75,000 computers and roughly 2,500 companies in the United States, Saudi Arabia, Egypt, Turkey, and Mexico were victims of "one of the largest and most sophisticated attacks by cyber criminals discovered to date."249 The attack began in 2008 and was not discovered until January 2010.250

In the United States, an unnamed Department of Justice official purportedly alleged that the "impact of the convention [is] 'very positive,'" which, again, seems to ignore the reality of cyber attack's scope.251 To the contrary, the Cybercrime Convention seems to merely limit the ability of a law-abiding entity to take proactive steps necessary to cease a cyber threat. 252

Because the Cybercrime Convention does not diminish cyber attacks, lacks any enforcement or prosecution mechanism and expressly states that signatory states pass domestic criminal laws covering "illegal access,"253 "illegal interception,"254 criminal "misuse of devices,"255 [emphasis added], the United States is not prevented from issuing letters of marque. If Congress exercised its constitutionally authorized power to issue letters of marque, limited to cyber operations, no violation of any provision of the Convention would occur because no domestic criminal acts occur.

Even the U.S. Attorney General stated, in 2006, that the Cybercrime Convention "is in full accord with all U.S. Constitutional protections."256 The activity undertaken pursuant to a constitutionally authorized and congressionally endorsed cyber letter of marque would not, under United States law, be illegal and thus not a violation of any provision contained in the Cybercrime Convention. In short, a cyber letter of marque issued by Congress would not violate the Council of Europe Convention on Cybercrime.

V. Authorizations and Oversight

While a cyber letter of marque is legal, both under domestic and international law, any cyber letter of marque regime must provide for a method of authorizing and subsequently supervising a cyber privateer. This section discusses some potential methods of authorization and oversight necessary for an effective cyber letter of marque regime.

A. Issuance of Bonds and Authorizations

Prior to the issuance of a letter of marque, all prospective cyber privateers should be required to register with a central governmental database. This database would provide the supervising agency257 with a means of not only policing cyber privateers and holding them accountable, but also a means for parties allegedly aggrieved by United States authorized cyber privateers to seek redress. Such a database and registration would also allow the supervisory agency an opportunity to vet the putative cyber privateer. "If a company does not have the skills to defend its systems, it likely does not have the skills to attack back-or make decisions about whether to engage in such actions."258 If the applicant does not possess the requisite skills, then its request for a cyber letter of marque is denied.259

Further, all applicants must be able to post a bond commensurate with potential liability exposure. "Letters of marque should only be issued to security firms able to post a significant bond and meet specific qualification and training requirements."260 The bond requirement is the most effective method for screening out "start-ups" and "fly-by-night" security companies from seeking a letter of marque.261 The Act Concerning Letters-of-Marque, Prizes & Prize Goods specifically states that before the issuance of any commission of letters of marque, a bond in the amount of five thousand dollars, or ten thousand dollars if the ship had more than one hundred and fifty men, would have to be paid by two "responsible sureties, not interested in such vessel."262 The payment of such a steep bond ensures that privateers strictly adhere to congressional rules.263

In a cyber context, since the stakes are so high, a prospective cyber privateer should be required to supply a large monetary bond.264 A large monetary bond would not only ensure that responsible entities apply for and receive cyber letters of marque, but also that those with the requisite discretion and technical expertise are the only ones acting with congressional authority as a cyber privateer. The prime importance of competent exercise of the powers enumerated in the letter of marque is underscored when the vast amount of money and intellectual property lost on a frequent and recurring basis, coupled with the exacting nature of establishing positive identification, especially attribution, is contemplated. A large monetary bond would, in effect, keep the cyber cutthroats out of this business.

Singapore established CaseTrust, a similar system, in order to protect consumers engaged in e-commerce. CaseTrust receives complaints against e-vendors and legitimizes member companies. Prior to joining, a prospective e-vendor must give a banker's guarantee, or a bond, to establish that it is indeed a legitimate and reputable company. The CaseTrust system provides for compulsory adjudication including the power to not only fine a vendor, but also to revoke its certification. As a result, the consumer is protected by providing a source of bonded companies and a policing mechanism. Additionally, the commercial entities are shrouded with governmental legitimacy. To date, enforcement has been effective and participation is growing.265

In a historical context, the putative privateer kept detailed daily logs, which were available for inspection by any U.S. naval commander he might encounter.266 Similar requirements would be made of cyber privateers. As all internet activity can be, or actually is, easily monitored,267 this requirement does not place too onerous a burden on the purported cyber privateer. While most private companies are loathe to share details of their cyber activity for fear of losing intellectual property, a competitive edge, or disclose their cyber defenses or weaknesses,268 a company serious about executing a defensive or even offensive cyber letter of marque should be willing to accept the more stringent scrutiny, such as reviewing cyber logbooks.

A cyber letter of marque would designate the bearers to be licensed combatants for the sovereign, authorizing them to "bear arms" in the cyber sense of the word, and either defend against specific attacks and launch counter attacks (hack-backs) or engage in offensive cyber operations directed at sovereign selected targets or networks.269 A private company could be granted authorization to conduct a hack-back, temporarily incapacitating a cyber bad actor, and then notify the appropriate law enforcement or national security entity for final apprehension or network termination.270

In recognition that cyber privateers would, to a certain extent, be bearing arms, a workable set of rules of engagement would necessarily be a major part of the actual commission. Professor Susan Brenner has expressed concerns that cyber privateers could be motivated to vigilantism and exceed the bounds of their charter, exhibiting an inability to determine who is a just target.271 These concerns can be easily alleviated by carefully drafted rules of engagement and scope of authorization in the letter of marque commission itself. If cyber privateers exceed the scope of the commission, they lose their substantial bond, face debarment from future government contracts, and open themselves up to potential criminal prosecutions since their actions were outside the scope of the immunity granted by the letter of marque. These adverse ramifications should keep a vetted and approved cyber privateer in line.

B. Legal and Judicial Oversight

The legal framework for a workable letter of marque regime already exists under current federal law.272 "Privateering worked only because it was backed by a substantial system of law, not only the common law of property, but also the statutory creations such as admiralty courts and bond requirements."273 The federal judiciary is vested with original jurisdiction to determine prizes,274 burdens of proof established,275 the due process rights of both the captor and the captive duly considered,276 and the interests of the United States represented by a duly appointed authority in the "United States attorney for the district in which the prize cause is adjudicated."277 In fact, Chapter 655 of 10 U.S.C. contains the entire statutory framework to judicially administer a letter of marque regime.

Historical precedence demonstrates that judicial oversight is an effective means to monitor and police privateers. For example, the court invalidated the first two prizes claimed during the War of 1812 because of improperly issued letters of marque.278 Even the venerable USS Constitution was also involved in an illegitimate capture, a situation embarrassingly rectified by the courts.279 Indeed, a rich legal history of privateering cases exists before the United States Supreme Court.280

Some are concerned that the government would not be able to control the behavior of modern privateers, especially in a cyber context.281 In reality, these concerns are easily addressed with stiff consequences.282 Penalties can include forfeiture of the bond and any pay due as a result of a successful capture or mission, seizure of assets,283 debarment from all future government contracts,284 exclusion from future letter of marque commissions, criminal prosecution, and potential tort liability. 285

At least two presidents proposed criminal prosecution for misuse of a letter of marque. President Jefferson, a major proponent of privateering during the Revolutionary War,286 declared that individuals operating off the coast without valid commissions be captured and tried as pirates.287 President Lincoln made a similar proclamation regarding privateers hired by the Confederate States, as he did not believe the "rebellious" states had legal authority to issue letters of marque.288

According to some scholars, one of the major drawbacks of the traditional letter of marque system was the lack of organization or unified command, control and communication.289 To address this concern, all cyber letter of marque holders would report their activities and progress to a central authority on a regular and recurring basis.290 This central authority would have the ability to terminate the cyber privateer's commission and/or refer the matter to the Department of Justice for criminal prosecution, should the commissionee act outside the bounds of authority. As this central authority would have an over-arching view of which cyber privateers were acting in which arenas, they could de- conflict any possible issues of interrupting law enforcement, intelligence, or national security operations in cyber space. Additionally, purely governmental agencies, such as the National Security Agency, would then be in a better position to work in concert with the cyber privateers to execute specific targeted operations.291

VI. Conclusion

"More destructive cyber weapons are being created every day . . . [eventually] . . . those who mean to harm the United States will gain the ability to launch a damaging attack. The United States must develop stronger defenses before this occurs."292 Despite this threat, the U.S. government seems to be content with merely allowing network owners to "[sit] there . . . trying to swat away these intrusions."293 Industry experts have specifically asked that Congress "provide opportunities and responsibilities to the private sector to hack back."294

Perhaps in tacit acknowledgement that the private sector is better prepared to handle cyber issues, the United States Air Force solicits private industry for capabilities designed to "destroy, deny, degrade, disrupt, deceive, corrupt, or usurp the adversaries [sic] ability to use the cyberspace domain for his advantage."295

Additionally, the Defense Advanced Research Projects Agency (DAPRA), through its "Plan X," sought "innovative research proposals" in an effort to "dominate the cyber battle space."296 Congress has not only denied these requests, while at the same time ignoring the Air Force and DARPA's proposed use of private industry, but at the same time tied their hands with respect to possible civil and criminal liability.297 Members of Congress have instead suggested legislative mandates requiring "owners and operators of vital infrastructure [to] better protect networks," or even tax credits as a means of encouraging corporations to establish stricter cyber security safeguards.298 Congress has failed to provide industry with the tools they are desperately asking for: a means in which to protect themselves in a meaningful way.

Political policy makers must understand that "[i]n cyberspace, the offense has the upper hand" and the nation cannot remain secure while hiding behind a mythical all protective firewall.299 Accordingly, Congress should exercise its constitutional authority and authorize the issuance of cyber letters of marque and allow American entities to actively defend themselves in cyber space.

As delineated above, the letter of marque has a rich tradition, not only in international and maritime law, but also in American history. Were it not for this power, the United States might not ever have gained her freedom, much less secured it in the War of 1812.300 The United States justly refused to acquiesce to a ban on privateering and that ban is not binding to this day.301 As advanced in this article, a cyber letter of marque can, with adequate safeguards in place,302 protect our current infrastructure, obtain information on emerging threats, and then eliminate such threats. Taking into account the current state of the law and the restrictions that prevent an adequate method of cyber self-defense, it becomes clear that a well thought out cyber letter of marque scheme would be able to address the fears that led to the enactment of the CFAA.

The current legal framework allows hackers to do what they please,303 while network owners must follow onerous statutory rules.304 The issuance of cyber letters of marque is a constitutionally authorized method of self-defense Congress should authorize to level the cyber playing field.

1 There were 2,405,518,376 Internet users accessing the Internet on 30 June 2012 alone. Enrique de Argaez, Internet Usage Statistics: The Internet Big Picture, INTERNET WORLD STATS http://www.internetworldstats.com/ stats.htm (last visited Aug, 20, 2013).

2 Tom Whitehead, Britain Is Target of Up to 1,000 Cyber Attacks Every Hour, TELEGRAPH, Oct. 22, 2012, http://www.telegraph.co.uk/news/ uknews/crime/9624655/Britain-is-target-of-up-to-1000-cyber-attacks- every-hour.html.

3 "Today we are not at war, but I see evidence every day of deliberate, organised attacks against intellectual property and government networks in the United Kingdom from cyber criminals or foreign actors with the potential to undermine our security and economic competitiveness." William Hague, Foreign Sec'y, U.K., Speech at Bletchley Park (Oct. 18, 2012), available at http://www.fco.gov.uk/en/news/latest-news/?view= Speech&id=824617382.

4 Shaun Waterman, Israel Faces Attack On Cyber Front As Artillery, Air Fight With Gaza Continues, WASH. TIMES, Nov. 19, 2012, http://www.washingtontimes.com/news/2012/nov/19/israel-faces-attack- on-cyber-front-as-artillery-ai/?page=all.

5 Nati Tucker & Orr Hirschauge, Cyber Offensive Against Israel: 100 Million Attacks with Little to Show for It, HAARETZ, Nov. 23, 2012, http:// www.haaretz.com/business/cyber-offensive-against-israel-100-million-at- tacks-with-little-to-show-for-it.premium-1.479998.

6 Robert McClelland, Att'y Gen., Austl., Ten Years On: The Budapest Convention-A Common Force Against Cybercrime (Nov. 28, 2011), available at http://www.attorneygeneral.gov.au/Speeches/Pages/2011/ Fourth%20Quarter/23-November-2011-Cyberspace%20-%20The%20new %20international%20legal%20frontier.aspx.

7 Adam Kredo, IAEA Incursion, WASH. FREE BEACON (Dec. 3, 2012, 5:00 AM), http://freebeacon.com/iaea-incursion/. The attack stole the personal information of 200 International Atomic Energy Agency (IAEA) scientists and highly sensitive information including satellite images. This was the second time in two weeks that hackers compromised the IAEA's internal computers.

8 China has infiltrated 141 companies in twenty industries and stolen "hundreds of terabytes of data." MANDIANT, APT 1: EXPOSING ONE OF CHINA'S CYBER ESPIONAGE UNITS (Feb. 19, 2013).

9 Jana Winter & Jeremy A. Kaplan, Washington Confirms Chinese Hack Attack on White House Computer, FOX NEWS.COM (Oct. 1, 2012), http:// www.foxnews.com/tech/2012/10/01/washington-confirms-chinese-hack-at- tack-on-white-house-computer/.

10 Greg MacSweeney, Can Banks Prevent the Next Cyber Attack?, WALL ST. & TECH. (Nov. 29, 2012), http://www.wallstreetandtech.com/data- security/can-banks-prevent-the-next-cyber-attack/240142926.

11 Josh Rogin, Who Runs Cyber Policy?, THE CABLE (Sep. 25, 2012), http: //thecable.foreignpolicy.com/posts/2010/02/22who_runs_cyber_policy.

12 Michael Riley & Eric Engleman, Why Congress Hacked Up a Bill to Stop Hackers, BUS. WK. (Nov. 15, 2012), http://www.busninessweek. com/articles/2012-11-15/why-congress-hacked-up-a-bill-to-stop-hackers.

13 Jeff Bardin, Caution: Not Executing Offensive Actions Against Our Adversaries Is High Risk, CSO SECURITY & RISK (Nov. 29, 2012), http:// blogs.csoonline.com/security-leadership/2469/caution-not-executing-offen- sive-actions-against-our-adversaries-high-risk?page=0.

14 Fellow signatories to the European Convention on Cyber Crime. See infra Part IV.

15 John Leyden, Crap Security Lands Sony £250,000 Fine for PlayStation Network Hack, THE REGISTER, Jan. 24, 2013, http://www.theregister.co. uk/2013/01/24/sony_psn_breach_fine/.

16 E.g., Charles Q. Choi, Auto-Immune: "Symbiotes" Could Be Deployed to Thwart Cyber Attacks, SCI. AM. (Nov. 26, 2012), http://www.scientific- american.com/article.cfm?id=auto-immune-symbiotes-could-be-deployed- to-thwart-cyber-attacks.

17 Congress is authorized to "grant Letters of Marque and Reprisal, and make Rules concerning Captures on Land and Water." U.S. CONST. art. I, § 8, cl. 11.

18 COMM. ON OFFENSIVE INFO. WARFARE, NAT'L RES. COUNCIL OF THE NAT'L ACADS., TECHNOLOGY, POLICY, LAW, AND ETHICS REGARDING U.S. ACQUISITION AND USE OF CYBERATTACK CAPABILITIES 208 (William A. Owens et al. eds., 2009) [hereinafter NRC REPORT].

19 Theodore T. Richard, Reconsidering The Letter of Marque: Utilizing Private Security Providers Against Piracy, 39 PUB. CONT. L.J. 452 (2010).

20 Id. at 452.

21 Alexander Tabarrok, The Rise, Fall and Rise Again of Privateers, 11 INDEP. REV.: J. OF POL. ECON., No. 4, at 575 (2007), available at http://www.independent.org/publications/tir/article.asp?a=631.

22 E.g., Elaine Supkis, Ron Paul Wrong on Letter of Marque and Reprisal, CULTURE OF LIFE NEWS (May 10, 2011, 2:32 PM), http://e,smews/word- press.com/2011/05/10/ron-paul-wrong-on-letter-of-marque-and-reprisal/.

23 H.R.J. Res. 290, 94th Cong. (1975); H.R.J. Res. 995, 94th Cong. (1976); H.R. 3074, 105th Cong. (2001); H.R. 3076, 107th Cong. (2001); and H.R. 3216, 110th Cong. (2007).

24 They were not a method through which the U.S. Government could instigate "conquest, revolution, or general mayhem." Kevin C. Marshall, Putting Privateers in Their Place: The Applicability of the Marque and Reprisal Clause to Undeclared Wars, 64 U. CHI. L. REV. 953, 958 (1997).

25 EDGAR STANTON MACLAY, HISTORY OF PRIVATEERS 214-15 (1900); Jules Lobel, Covert War and Congressional Authority: Hidden War and Forgotten Power, 134 U. PA. L. REV. 1035, 1044 (1986); Marshall, supra note 24, at 958.

26 See Robert P. DeWitte, Let Privateers Marque Terrorism: A Proposal for a Reawakening, 82 IND. L.J. 131, 140 (2007).

27 Originally, there was a distinction between a privateer and a letter of marque, however most scholars agree that by the time of the American Revolution there was no substantive difference between a letter of marque and privateer commission. See Richard, supra note 19, at 425. Therefore, for purposes of this paper, we will use Sir Thomas Barclay's definitions of letter of marque and privateer: "a privateer is a private vessel, the captain of which received a commission (letters of marque) to carry on war and effect captures at his own risk and expense." THOMAS BARCLAY, PROBLEMS OF INTERNATIONAL PRACTICE AND DIPLOMACY, WITH SPECIAL REFERENCE TO THE HAGUE CONFERENCES AND CONVENTIONS AND OTHER GENERAL INTERNATIONAL AGREEMENTS 204 (1907). Considerable research and writing is devoted to defining these terms and to their respective history should the reader wish to pursue this discussion in more depth. See, e.g., Richard, supra note 19 at 423-25; Todd Emerson Hutchins, Structuring a Sustainable Letters of Marque Regime: How Commissioning Privateers Can Defeat the Somali Pirates, 99 CAL. L. REV. 819, 844 (2011).

28 See generally THOMAS GIBSON BOWLES, THE DECLARATION OF PARIS OF 1856: BEING AN ACCOUNT OF THE MARITIME RIGHTS OF GREAT BRITAIN; A CONSIDERATION OF THEIR IMPORTANCE; A HISTORY OF THEIR SURRENDER BY THE SIGNATURE OF THE DECLARATION OF PARIS; AND AN ARGUMENT FOR THEIR RESUMPTION BY THE DENUNCIATION AND REPUDIATION OF THAT DECLARATION 77 (1900) (referencing the Consolato del Mare, in 3 WILLIAM BLACKSTONE COMMENTARIES 250 (1765-1769)), available at http://www.gutenberg.org/files/30802/30802- h/30802-h.htm ("These letters are grantable by the law of nations.").

29 See infra Part IV.A (detailing discussion of why The Declaration of Paris is not applicable to the United States and the application of letters of marque to the cyber arena.).

30 HUGO GROTIUS, THE RIGHTS OF WAR AND PEACE 312 (1624).

31 Larry J. Sechrest, Privateering and National Defense: Naval Warfare for Private Profit (2003), reprinted in The Myth of National Defense: Essays on the Theory and History of Security Production 247 (Hans-Hermann Hoppe ed., 2003).

32 See, e.g., Richard, supra note 19, at n.75; Hutchins, supra note 27, at 845; Marshall, supra note 24, at 954.

33 Marshall, supra note 24, at 954.

34 Richard, supra note 19, at 416.

35 DeWitte, supra note 26, at 132; Richard, supra note 19, at 427. The colonial governments relied on privateering "to augment their weak navies." Id.

36 DeWitte, supra note 26, at 134.

37 WORTHINGTON CHAUNCEY FORD, ED, 4 JOURNALS OF THE CONTINENTAL CONGRESS 1774-1789, at 229-33 (Mar. 23, 1776) (GPO 1906) (providing text of the resolution delineating national rules for letter of marque).

38 CHARLES OSCAR PAULLIN, THE NAVY OF THE AMERICAN REVOLUTION: ITS ADMINISTRATION, ITS POLICY, AND ITS ACHIEVEMENTS 148 (1906); Mass Armed Vessels Act, 1775, Mass Acts. ch. 7, reprinted in 5 Mass Acts and Resolves 436-37.

39 Marshall, supra note 24, at 960.

40 DeWitte, supra note 26, at 134; SECHREST, supra note 31, at 247.

41 Richard, supra note 19, at 437 (citing Letter from Thomas Jefferson, to Gouverneur Morris (Aug. 16, 1793)), in 3 MEMOIR, CORRESPONDENCE AND MISCELLANIES FROM THE PAPERS OF THOMAS JEFFERSON 275 (1829).

42 Tabarrok, supra note 21, at 567.

43 Id.; see generally WILLIAM BELL CLARK, BEN FRANKLIN'S PRIVATEERS (1956).

44 Tabarrok, supra note 21, at 567.

45 CARL E. SWANSON, PREDATORS AND PRIZES: AMERICAN PRIVATEERING AND IMPERIAL WARFARE, 1739-1748, at 1 (Univ. of S.C. Press 1991).

46 JAMES A. HUSTO, THE SINEWS OF WAR: ARMY LOGISTICS 1775-1953, at 21 (1966).

47 ROGER KNIGHT, THE PURSUIT OF VICTORY: THE LIFE AND ACHIEVEMENT OF HORATIO NELSON 45 (2005).

48 SECHREST, supra note 31, at 250.

49 MACLAY, supra note 25, at viii.

50 Id. ("God knows, if this American war continues much longer we shall all die with hunger.").

51 Id.

52 Id. at xii ("'In no former war,' said a contemporary English newspaper, 'not even in any of the wars with France and Spain, were the linen vessels from Ireland to England escorted by war ships.'").

53 FRANCIS R. STARK, THE ABOLITION OF PRIVATEERING AND THE DECLARATION OF PARIS 127 (1897).

54 MIRIAM GREENBLATT & JOHN STEWART LOWMAN, WAR OF 1812, at 82 (John S. Bowman ed., 1994) (2003) (British naval officers described the U.S. Navy as "bundles of pine boards" with "bits of striped rag floating over them.").

55 An Act Concerning Letters of Marque, Prizes, and Prize Goods, ch. 107, § 9, 2 Stat. 759, 761 (1812).

56

Id.

57 FRANCIS H. UPTON, THE LAW OF NATIONS AFFECTING COMMERCE DURING WAR: WITH A REVIEW OF THE JURISDICTION, PRACTICE AND PROCEEDINGS OF PRIZE COURTS 181 (1863).

58 See JEROME R. GARITEE, THE REPUBLIC'S PRIVATE NAVY: THE AMERICAN PRIVATEERING BUSINESS AS PRACTICED BY BALTIMORE DURING THE WAR OF 1812, at 244 (Wesleyan Univ. Press 1977).

59 MACLAY, supra note 25, at ix (dollar equivalency for 2012 ($39,000,000 to $672,413,793.10) calculated using http://www.davemanuel.com/ inflation-calculator.php/).

60 UPTON, supra note 57, at 175.

61 TEXAS PRIVATEERS, https://www.tsl.state.tx.us/exhibits/navy/privateers. html (last modified Aug. 30, 2011).

62 Although President Polk did take issue with the blank letters of marque issued by Mexico, arguing those were illegal under international law and those acting in accordance with such letters are considered to be pirates. UPTON, supra note 57, at 182.

63 1856 Paris Declaration Respecting Maritime Law (1856), reprinted in THE LAW OF NAVAL WARFARE: A COLLECTION OF AGREEMENTS AND DOCUMENTS WITH COMMENTARIES 64 (Natalino Ronzitti ed., 1987) [hereinafter PARIS DECLARATION].

64 What influenced especially the English Government was the fear of America inclining against us, and lending to our enemies the co-operation of her hardy volunteers. The Maritime population of the United States, their enterprising marine, might furnish to Russia the elements of a fleet of privateers, which attached to its service by Letters of Marque and covering the seas with a network would harass and pursue our commerce even in the most remote waters.

TRAVERS TWISS, BELLIGERENT RIGHT ON THE HIGH SEAS, SINCE THE DECLARATION OF PARIS 10 (1856) (1884).

65

Richard, supra note 19, at 428.

66 "Privateering is, and remains, abolished. . . . The present Declaration is not and shall not be binding, except between those Powers who have acceded, or shall accede, to it." Id.

67 A fourth provision dealing with naval blockades that is not germane to the instant discussion. See PARIS DECLARATION, supra note 63, at 65.

68 Id. at 64-65.

69 Id. at 65.

70 See Hutchins, supra note 27, at 855.

71 "The present Declaration is not and shall not be binding, except between those Powers who have acceded, or shall accede, to it." PARIS DECLARATION, supra note 63, at 65; Hutchins, supra note 27, at 855.

72 EPHRAIM DOUGLASS ADAMS, GREAT BRITAIN AND THE AMERICAN CIVIL WAR 141 (1925).

73 Id.

74 Id.

75 Id.

76 ELBERT JAY BENTON, INTERNATIONAL LAW AND DIPLOMACY OF THE SPANISH AMERICAN WAR 129 (1908).

77 ADAMS, supra note 72, at 141.

78 PARIS DECLARATION, supra note 63, at 61-62.

79 Confederate Cong., An Act Recognizing the Existence of War Between the United States and Confederate States, and Concerning the Letters of Marque, Prizes, and Prize Goods (1st Sess. Apr. 29, 1861).

80 ADAMS, supra note 72, at 141; JAMES D. RICHARDSON, A COMPILATION OF THE MESSAGES AND PAPERS OF THE CONFEDERACY INCLUDING DIPLOMATIC CORRESPONDENCE 1861-1865, at 60-62 (1905); MACLAY, supra note 25, at 504.

81 The Union approached Great Britain, France, Russia, Prussia, Austria, Belgium, Italy, Denmark, and the Netherlands. ADAMS, supra note 72, at 141.

82 ADAMS, supra note 72, at 141; STARK, supra note 53, at 155.

83 Alexander Porter Morse, Rights and Duties of Belligerents and Neutrals from the American Point of View, 46 AM. L. REG. 657, 659-60 (1898).

84 An Act Concerning Letters of Marque Prizes, and Prize Goods, ch. 85, 12 Stat. 758 (1863). Lincoln never commissioned any Union privateers. Richard, supra note 19, at 428.

85 See JAMES RUSSELL SOLEY, THE BLOCKADE AND THE CRUISERS 170 (1883) (noting this meant pirates would be subject to execution).

86 Hutchins, supra note 27, at 857.

87 See PARIS DECLARATION, supra note 63, at 61-62 (providing a list of signatories and dates signed).

88 BARCLAY, supra note 27, at 204.

89 On 23 April 1898, Regent Queen Maria Cristina signed a declaration stating, among other things, that "Captains, skippers, officers of ships . . . not being Americans mak[ing] acts of war against Spain, will be considered as pirates . . . although they are protected by American letters of marque for privateers." KENNETH E. HENDRICKSON, JR., THE SPANISH-AMERICAN WAR 128 (Greenwood Publishing Group 2003).

90 Morse, supra note 83, at 660.

91 BARCLAY, supra note 27, at 205. This scheme seems to have originated with the Prussians, who created a "volunteer navy" in 1870 in an attempt to circumvent the restrictions agreed up in Paris. The Prussians proposed putting civilian merchant seaman in Prussian navy uniforms and leaving them in command of their civilian ships. The French protested, claiming this to be privateering, in violation of the Declaration of Paris, and appealed to the British Secretary of Foreign Affairs, who sided with Prussia. Id.

92 HENDRICKSON, supra note 89, at 127-28; BARCLAY, supra note 27, at 204.

93 BARCLAY, supra note 27, at 204.

94 According to the agreements, the owner was required "to take on board two naval officers, a marine officer, and a guard of thirty marines" and the owner was to pay for all costs, which were reimbursable after certification by the senior U.S. Naval officer on board. Id. at 205.

95 She was re-flagged as Yale. The Rita, 89 F. 763, 764 (1898).

96 BARCLAY, supra note 27, at 205.

97 The Rita, 89 F. at 768.

98 JOSEPH HODGES CHOATE, THE SECOND INTERNATIONAL PEACE CONFERENCE, HELD AT THE HAGUE FROM JUNE 15 TO OCTOBER 18, 1907: INSTRUCTIONS TO AND REPORT FROM DELEGATES OF THE UNITED STATES, CONVENTIONS AND DECLARATIONS, FINAL ACT, WITH DRAFT OF CONVENTION RELATIVE TO THE CONVENTIONS (1908).

99 See supra Part II.

100 CHOATE, supra note 98, at 40. 101 Id.

102 Some have alleged that blimps operated on the west coast of the United States during World War II pursuant to letters of marque. "The Los Angeles based Resolute was the only airship . . . operated for the Navy under privateer status. . . ." JAMES SHOCK & DAVID SMITH, THE GOODYEAR AIRSHIPS 43 (2002). However, no congressional authorization was ever issued. See Richard, supra note 19, n.121; R.G. Van Treuren, The Goodyear Airships, NOON BALLOON, No. 83, 2009 at 6-7, available at http://www.naval-airships.org/resources/Documents/tnb83.pdf (providing a more detailed discussion).

103 See supra note 23.

104 Richard, supra note 19, at 416.

105 Marshall, supra note 24, at 969 (quoting a letter from John Adams to the President of Congress).

106 Kathy Lally, Russian Crime Boss Gunned Down in Moscow, WASH. POST, Jan. 16, 2013, http://www.washingtonpost.com/world/europe/russian -crime-boss-gunned-down/2013/01/16/5b8663ac-600b-11e2-9940-6fc488f3fecd_story.html?tid=pm_pop; Press Release, U.S. Dep't Treas., Treasury Designates Brothers' Circle Members (June. 6, 2012), available at http://www.treasury.gov/press-center/press-releases/Pages/tg1605.aspx; Exec. Order No. 13,636, 78 Fed. Reg. 11,739 (Feb. 19, 2013).

107 Since 2006, at least eight United Nations (UN) Security Council Resolutions (UNSCR) have attempted to secure Iranian compliance with various international mandates. See, e.g., S.C. Res. 1696, U.N. Doc. S/RES/1696 (July 31, 2006), available at http://www.un.org/News/Press/ docs/2006/sc8792.doc.htm; S.C. Res. 1737, U.N. Doc. S/RES/1737 (Dec. 27, 2006), available at http://www.un.org/News/Press/docs/2006/sc8928. doc.htm; S.C. Res. 1747, U.N. Doc. S/RES/1747 (Mar. 24, 2007), available at http://www.un.org/apps/news/story.asp?NewsID=21997&Cr=Iran&Cr1 =; S.C. Res. 1803, U.N. Doc. S/RES/1803 (Mar. 3, 2008), available at http: //www.un.org/News/Press/docs/2008/sc9268.doc.htm; S.C. Res. 1835, U.N. Doc S/RES/1835 (Sept. 27, 2008), available at http://www.un.org/ News/Press/docs/2008/sc9459.doc.htm; S.C. Res. 1929, U.N. Doc. S/RES/1929 (June 9, 2010), available at http://www.unhcr.org/refworld/ docid/4c1f2eb32.html; S.C. Res. 1984, U.N. Doc. S/RES/1984 (June 9, 2011), available at http://www.un.org/News/Press/docs/2008/sc9459.doc. htm; S.C. Res. 2049, U.N. Doc. S/RES/2049 (June 7, 2012), available at http://www.un.org/News/Press/docs/2012/sc10666.doc.htm; Factbox: Sanctions Imposed on Iran, REUTERS, Jan. 20, 2011, available at http://www.reuters.com/article/2011/11/22/us-iran-sanctions- -fb-idUSTRE7AL11K20111122 (an over-view "of major sanctions imposed on Iran by the United States, the United Nations and the European Union over the years").

108 Suzanne Maloney, The Revolutionary Economy, U.S. INST. OF PEACE, http://iranprimer.usip.org/resource/revolutionary-economy (last visited Dec. 18, 2012).

109 See, e.g., Jessica Silver-Greenberg, Regulator Says British Bank Helped Iran Hide Funds, N.Y. TIMES, Aug. 6, 2012, http://www.nytimes.com/2012 /08/07/business/standard-chartered-bank-accused-of-hiding-transactions- with-iranians.html?pagewanted=all&_r=0.

110 Agustino Fontevecchia, Standard Chartered Hid 60,000 Transactions With Iranian Banks Worth $250B, FORBES (Aug. 6, 201212:38 PM), http://www.forbes.com/sites/afontevecchia/2012/08/06/standard-chartered- hid-60000-transactions-with-iranian-banks-worth-250b/.

111 Jessica Silver-Greenberg, Prosecutors Link Money from China to Iran, N.Y. TIMES, Aug. 29, 2012, http://www.nytimes.com/2012/08/30/ business/inquiry-looks-at-chinese-banks-iran-role.html.

112 British Bank Makes $2 Billion Settlement on Money Laundering Charges, PBS NEWSHOUR, Dec. 11, 2011 (transcript and video available at http://www.pbs.org/newshour/bb/business/july-dec12/hsbc_12-11.html).

113 Illicit Money: How Much Is Out There?, U.N. OFF. DRUGS CRIME (Oct. 25, 2011), http://www.unodc.org/unodc/en/frontpage/2011/October/illicit- money_-how-much-is-out-there.html. Organized crime includes drug trafficking, counterfeiting, human trafficking, and small arms smuggling.

114 This figure does not include funds lost to tax evasion. Most of the roughly $35 billion income earned from cocaine sales in North America was laundered in North America and Europe. Id. The impact of tax evasion on this number is difficult to accurately determine due to the type of tax evaded (personal income tax, corporate tax, property tax, etc.) and the means and methods of actually calculating tax rates differ so much from nation to nation. PETER REUTER & EDWIN M. TRUMAN, CHASING DIRTY MONEY: THE FIGHT AGAINST MONEY LAUNDERING 12 (2004).

115 See, e.g., John Eligon, Credit Suisse Settles Inquiry Over Iran Sanctions, N.Y. TIMES, Dec. 16, 2009, http://www.nytimes.com/2009/12/17/ business/global/17suisse.html?_r=1 (reporting that Credit Suisse bank agrees to pay $536 million to settle charges of laundering from $700 million to $1.1 billion); Jessica Silver-Greenberg, British Bank in $340 Million Settlement for Laundering, N.Y. TIMES, Aug. 14, 2012, http://www.nytimes.com/2012/08/15/business/standard-chartered-settles- with-new-york-for-340-million.html (discussing the agreement that the defendant bank would pay $340 million in fines for laundering $250 billion in Iranian funds).

116 U.N. OFF. DRUGS CRIME, ESTIMATING ILLICIT FINANCIAL FLOWS RESULTING FROM DRUG TRAFFICKING AND OTHER TRANSNATIONAL ORGANIZED CRIMES 5 (Oct. 25, 2011) [hereinafter TRANSNATIONAL ORGANIZED CRIME], available at http://www.unodc.org/documents/ data-and-analysis/Studies/Illicit_financial_flows_2011_web.pdf.

117 Illicit Money: How Much Is Out There?, supra note 113.

118 TRANSNATIONAL ORGANIZED CRIME, supra note 116, at 5.

119 Marshall, supra note 24.

120 Id. at 958. Marshall simplistically asserts that privateering was primarily a money seeking venture and did not serve a valid military objective, without recognizing both goals are interchangeable.

121 PAULLIN, supra note 38, at 150-51. While downplaying the role of privateers and alleging they were merely profit seekers and not patriotic, Paullin later admits the "supplies captured from the British were often almost indispensable to the colonists." Id. at 152.

122 DONALD A. PETRIE, THE PRIZE GAME 3-4 (1999) (comparing privateering to gambling, which could result in "fortunes [brought] home from the sea").

123 MACLAY, supra note 25, at 7.

124 Richard, supra note 19, at 426.

125 See infra Part V.

126 See supra Part II.

127 Literally translated means "thief in law." See KREBS ON SECURITY, New Findings Lend Credence to Project Blitzkrieg, http://krebsonsecurity.com/ tag/vorvzakone-gozi-prinimalka/ (last visited Dec. 12, 2012).

128 While the exact identity of vorKzakone is unknown, he is believed to be a male, as shown by alleged photographs of vorKzakone online.KREBSONSECURITY.COM, http://krebsonsecurity.com/wp-content/ uploads/2012/10/vorvnsdyt.png (last visited Feb. 21, 2013).

129 Bloomberg News, vorVzakone's Blitzkrieg Cyber Threat 'Credible,' McAfee Says, NEWSDAY (Dec. 19, 2012, 9:05 AM), http://newyork.news- day.com/business/technology/vorvzakone-s-blitzkrieg-cyber-threat-credible -mcafee-says-1.4352294.

130 See MCAFEE, http://home.mcafee.com/Root/AboutUs.aspx (last visited Feb. 21, 2013) (describing services offered and establishing credibility to make these determinations).

131 Blitzkrieg Cyber Threat, supra note 129.

132 David McMillin, Banks vs. Cybercriminals, BANKRATE.COM, http:// www.bankrate.com/financing/banking/banks-vs-cybercriminals/ (Dec. 15, 2012, 6:00 AM).

133 KREBS ON SECURITY, supra note 127.

134 Id.

135 Nicole Perlroth & Quentin Hardy, Bank Hacking Was the Work of Iranians, Officials Say, N.Y. TIMES, Jan. 8, 2013, http://www.nytimes.com. 2013/01/09/technology/online-banking-attacks-were-work-of-iran-us-offi- cials-say.html?hp&_r=1&.

136 Id.

137 Id.

138 Id.

139 Lee Ferran, Iran Denies Cyber Attacks on U.S. Banks, ABC NEWS, Jan. 11, 2013, http://abcnews.go.com/Blotter/iran-denies-cyber-attacks-us- banks/story?id=18191088. The entity taking credit for the attacks, the al- Qassam Cyber Fighters, also denies any State involvement. Id.

140 N. Korea Possesses Considerable Cyber Hacking Capability: Experts, YONHAP NEWS AGENCY, Jan. 17, 2013, available at http://english. yonhapnews.co.kr/northkorea/2013/01/17/18/0401000000AEN2013011700 8600315F.HTML.

141 Id.

142 Siobhan Gorman & Danny Yadron, Banks Seek U.S. Help on Iran Cyberattacks, WALL ST. J., Jan. 15, 2013, http://online.wsj.com/article/SB 10001424127887324734904578244302923178548.html.

143 COMPUTER CRIME AND INTELL. PROP. SEC., U.S. DEP'T OF JUST., PROSECUTING COMPUTER CRIMES 180 (2007), available at http://www. justice.gov/criminal/cybercrime/docs/ccmanual.pdf.

144 RICHARD A. CLARKE & ROBERT K. KNAKE, CYBER WAR: THE NEXT THREAT TO NATIONAL SECURITY AND WHAT TO DO ABOUT IT 127 (2010).

145 Gorman & Yadron, supra note 142.

146 Bardin, supra note 13.

147 Id.; Jody Westby, Caution: Active Response to Cyber Attacks Has High Risk, FORBES.COM, Nov. 29, 2012, http://www.forbes.com/sites/ jodywestby/2012/11/29/caution-active-response-to-cyber-attacks-has-high- risk/.

148 N. Korea Possesses Considerable Cyber Hacking Capability: Experts, supra note 140.

149 See, e.g., TREADSTONE 71, https://www.treadstone71.com/andCROWD- STRIKE, http://www.crowdstrike.com/services.html.

150 As Jeff Bardin says, "[a]s my information is being stolen, leveraged against me and used to impersonate me (like scores of thousands of other citizens), we continue to sit in rooms and discuss what to do." Bardin, supra note 13.

151 This is as opposed to merely defending against it using tactics such as firewalls, which can be breached. See generally JOEL SCAMBRAY, GEORGE KURTZ & STUART MCCLURE, HACKING EXPOSED 464-65 (5th ed. 2005). Even the supposedly secure Johns Hopkins University Advanced Physics Laboratory (APL), which has contracts with the National Security Agency, was successfully hacked in 2009, which led to the loss of sensitive data in massive amounts. CLARKE & KNAKE, supra note 144, at 127.

152 "Most cyber criminals have absolutely no defensive posture whatsoever. When hit with an offensive attack, they quickly shift their targets since it is not cost effective and their whole intent is economic in nature." Bardin, supra note 13.

153 See supra Part II.

154 Id.

155 KNIGHT, supra note 47, at 45.

156 MACLAY, supra note 25, at xiii.

157 GEORGE COGGESHALL, HISTORY OF THE AMERICAN PRIVATEERS AND LETTERS-OF-MARQUE, DURING OUR WAR WITH ENGLAND IN THE YEARS 1812, '13, AND '14, at 5 (1856) (describing the Privateer America, which captured twenty-seven British ships during five sorties during the War of 1812).

158 83 U.S. 366 (1872). The language usually cited as Supreme Court authorization for bounty hunting states:

When bail is given, the principal is regarded as delivered to the custody of his sureties. Their dominion is a continuance of the original imprisonment. Whenever they choose to do so, they may seize him and deliver him up in their discharge; and if that cannot be done at once, they may imprison him until it can be done. They may exercise their rights in person or by agent. They may pursue him into another State; may arrest him on the Sabbath; and, if necessary, may break and enter his house for that purpose. The seizure is not made by virtue of new process. None is needed. It is likened to the rearrest [sic] by the sheriff of an escaping prisoner.

Id. at 371 (emphasis added).

159 The U.S. Marshal Service offers monetary bounties of up to $25,000 for the capture of their "most wanted," as depicted on their web page. Fugitive Investigations-15 Most Wanted, U.S. MARSHALS SERV., http://www.usmarshals.gov/investigations/most_wanted/index.html (last visited Feb. 21, 2013). Likewise, the FBI has its own list of wanted fugitives, offering $100,000 to $1 million for their capture. Wanted by the FBI-Ten Most Want ed, av ai lable a t FED. BUREAU INVES TI GA TION, htt p://www. fbi .g ov/ wanted/topten (last visited Feb. 21, 2013).

160 The $25 million reward was still active on the FBI's page days after he was killed in 2011. See Andrew Malcolm, $25-Million Bounty on Bin Laden Is Still Being Advertised by the FBI, L.A. TIMES, May 4, 2011, http://latimesblogs.latimes.com/washington/2011/05/25-million-bounty-on- bin-laden-was-it-withdrawn.html.

161 REWARDS FOR JUSTICE, http://www.rewardsforjustice.net/ (last visited Feb. 21, 2013).

162 Rob Wile, Iceland Has Hired an Ex-Cop to Hunt Down the Bankers That Wrecked Its Economy, BUS. INSIDER (Jul. 12, 2012), http://www.business-insider.com/iceland-has-hired-an-ex-cop-bounty- hunter-to-go-after-the-bankers-that-wrecked-its-economy-2012-7.

163 See BAIL BOND LAWS, http://fugitiverecovery.com/bail-bond- laws/overview/ for a fairly thorough summary of each state's laws as of 2001 (summarizing fifty state laws) (last visited Feb. 15, 2013).

164 See VA. CODE ANN. §§ 9.1-186 to 186.13 (2008); 6 VAC 20-260 (Regulations Relating to Bail Enforcement Agents); Bail Enforcement Agent, VA. DEP'T CRIM. JUSTICE SERVS. http://www.dcjs.virginia.gov/pss/ special/bailenforcementagent.cfm (last visited Feb. 10, 2013).

165 See VA. CODE ANN. § 9.1 to 186.13.

166 See, e.g., FLA. STAT. ANN. § 648.30 (2011).

167 See, e.g., 725 ILL. COMP. STAT. 5/103-9 (2009).

168 The Michigan Department of Licensing and Regulatory Affairs specifically states that no licensing is required to be a bounty hunter in the State of Michigan: "Q: How do I become a bounty hunter (skip tracer)? A: A license is not required in Michigan to become a bounty hunter or skip tracer." MICH. DEP'T OF LICENSING AND REG. AFF., http://www/michigan. gov/lara/0,4601,7-154-35299_10555_13648-141139-,00.html (last visited Jan. 22, 2013).

169 See, e.g., NAT'L ASS'N FUGITIVE RECOVERY AGENTS (N.A.F.R.A.), http://fugitive-recovery.org/ (last visited Dec. 24, 2012); NAT'L ASS'N BAIL BOND INVESTIGATORS, http://nabbi.org/ (last visited Dec. 24, 2012).

170 The Computer Fraud and Abuse Act, 18 U.S.C. § 1030 (2006), would most likely prevent a company or individual from taking these steps. See infra Part IV.

171 Corporations such as CrowdStrike or Treadstone 71 purportedly offer services that can be used to gather information from an adversary's computers to support an arrest by federal, state, or local law enforcement entities. See supra note 149.

172 DeWitte, supra note 26, at 146-47.

173 Id. at 147.

174 U.S. CONST. art. I, § 8, cl. 11.

175 Hutchins, supra note 27, at 879-81. Hutchins details the history of the Bounty Act and associated jurisprudence. While Congress repealed the Bounty Act in 1899, "[a]ll the courts' jurisprudence on the law of capture remains unchanged and con tinues to h old that b oun ty and prize are constitutional." Id.

176 31 U.S.C. §§ 3729-3733 (2006).

177 18 U.S.C. § 1030 (2006).

178 This included not only government computers and networks, but also those of large banks, the New York Stock Exchange, etc. Robert B. Fitzpatrick, Computer Fraud and Abuse Act: Current Developments, SS006 A.L.I.-A.B.A. 1035, 1037 (2010).

179 Bardin, supra note 13.

180 The expanding scope of the Computer Fraud and Abuse Act (CFAA) has been described by Eric Goldman, professor at Santa Clara University School of Law, as "Frankenstein-ing," resulting in a "horrible, hideous monster." See Aaron Pressman, Anti-hacking Law Questioned After Death of Internet Activist, REUTERS, Jan. 15, 2013, available at http://www. reuters.com/article/2013/01/15/us-swartz-idUSBRE90E17U20130115.

181 "Damage" is "any impairment to the integrity or availability of data, a program, a system, or information." 18 U.S.C. § 1030(e)(8).

182 "Loss" includes "any reasonable cost to the victim." See id. § 1030(e)(11).

183 See id. § 1030(g).

184 See id. § 1030(e)(2).

185 See id. § 1030(e)(2)(B).

186 Jay P. Kesan & Carol M. Hayes, Thinking Through Active Defense in Cyberspace, NAT'L ACAD. PRESS (Oct. 12, 2010), available at http:// papers.ssrn.com/abstract=1691207.

187 See, e.g., Jay P. Kesan & Carol M. Hayes, Mitigative Counterstriking: Self-Defense and Deterrence in Cyberspace, 25 HARV. J.L. & TECH. 415, 494 (2012).

188 Moulton v. VC3, 2000 WL 33310901 (N.D. Ga., 2000).

189 Nor were these acts in violation of the Georgia Computer Systems Protection Act (1991). GA. CODE ANN. § 16-9-91 (1991).

190 United States v. Czubinski, 106 F.3d 1069 (1st Cir. 1997).

191 "[M]erely viewing information cannot be deemed the same as obtaining something of value for purposes of this statute . . . [t]he Government failed . . . to prove . . . [Defendant] . . . intended anything more than to satisfy idle curiosity." Id. at 1078.

192 Conducting throughput tests and scanning ports can detect system weaknesses, better positioning an attacker for follow-on action at a later date, if need be. While seemingly innocent, this could be an effective Operation Preparation of the Environment (OPE) for full scale cyber conflict. Due to sensitivity of the information discussed (cyber self-help), the expert agreed to be interviewed on the condition of anonymity. Interview with Cyber Security Expert (Nov. 2012) (notes on file with author).

193 See, e.g., NRC REPORT, supra note 18 (discussing the exemption for lawfully authorized law enforcement and intelligence agencies activities to the CFAA and how government agencies may commandeer private computes or pay for their usage).

194 See supra Part I (discussing of the frequency of cyber attacks). The CFAA, in one form or another, has been in effect since 1984. It has had little to no affect on cyber attacks.

195 See, e.g., Westby, supra note 147.

196 Ms. Westby, while arguing a cyber victim should turn over information to law enforcement instead of proactively defending themselves, admits that "there are too few of them with skills adequate to match the sophisticated nature of today's cyber criminals." Id. Others have agreed with her assessment that there are too few cyber-competent law enforcement officers. Bardin, supra note 13.

197 "[S]treet criminals were not stealing my Xbox and then fleeing to a foreign jurisdiction where the local authorities had no control." Zach, Active Defense Has High Risk, But So Does Inaction: Forbes/CSO, CYBER SECURITY LAW & POL'Y (Dec. 1, 2012), http://blog.cybersecuritylaw.us/ 2012/12/01/active-defense-has-high-risk-but-so-does-inaction-forbescso/ (providing counter arguments to Westby's simplistic arguments against self help).

198 An individual basically set up a honey pot webpage attracting Al-Qaeda militants. He turned over the information the FBI, who failed to act in a timely manner and the militants identified the site as a phony and warned their cohorts away. Associated Press, Man Hijacks Al-Qaeda Site for FBI Use, USA TODAY, http://usatoday30.usatoday.com/tech/news/2002-07-30-al-qaeda-online_x.htm (last visited Dec. 21, 2012).

199 Heidi Blake, Eastern European Cyber Criminal's Draining British Bank Accounts, TELEGRAPH, Aug. 11, 2010, http://www.telegraph.co.uk/ finance/personalfinance/consumertips/banking/7938184/Eastern-European- cyber-criminals-draining-British-bank-accounts.html.

200 Alexander Melnitzky, Defending America Against Chinese Cyber Espionage Through the Use of Active Defenses, 20 CORDOZO J. INT'L & COMP. L. 537, 540 (2012).

201 That is, the cyber bad actor who is committing the misconduct leading to the letter of marque commission.

202 Kesan & Hayes, supra note 187, at 481.

203 Id. at 451.

204 Id. at 481-82.

205 Bardin, supra note 13.

206 Lieutenant Commander Matthew J. Sklerov, Solving the Dilemma of State Responses to Cyberattacks: A Justification for the Use of Active Defenses Against States Who Neglect Their Duty to Prevent, 201 MIL. L. REV. 1, 77 (2009).

207 CLARKE & KNAKE, supra note 144 at 20.

208 Melnitzky, supra note 200, at 555 (quoting Robert K. Knake's testimony before the House Sub-committee on Technology and Innovation for the House Committee on Science and Technology).

209 Kesan & Hayes, supra note 187, at 330 (providing a basic discussion of the technologies available to ensure accurate attribution).

210 See supra note 5.

211 Kesan & Hayes, supra note 187.

212 See, e.g., Westby, supra note 147; Susan Brenner, Marque and Reprisal, CYB3RCRIM3 BLOG (May 18, 2009, 7:39 AM), http://cyb3rcrim3. blogspot.com/search?q=marque.

213 PARIS DECLARATION, supra note 63.

214 Vienna Convention on the Law of Treaties, art. 26, 23 May 1969, 1155 U.N.T.S. 331 [hereinafter Law of Treaties]. The United States has signed, though not ratified, this treaty. Nevertheless, the United States follows these rules in large part.

215 Id. art. 34

216 Id.

217 Id. art. 35.

218 "That maritime law, in time of war, has long been the subject of deplorable disputes." Paris Declaration, supra note 63, at 64.

219 Richard, supra note 19, at 429. But see DeWitte, supra note 26, at 132 ("The United States, however, is not a signatory to this treaty, and Congress could revive letters of marque and reprisal at any time.").

220 "Nothing in articles 34 to 37 precludes a rule set forth in a treaty from becoming binding upon a third State as a customary rule of international law, recognized as such." Law of Treaties, supra note 215, art. 38.

221 Customary Int'l Humanitarian Law, INT'L COMM. RED CROSS, http://www.icrc.org/customary-ihl/eng/docs/v1_rul_in_asofcuin (last visited Dec. 21, 2012). See Joel P. Trachtman, Persistent Objectors, Cooperation, and the Utility of Customary International Law, 21 DUKE J. COMP. & INT'L L. 221 (2010) (providing a more detailed discussion of the persistent objector concept).

222 This is the crux of the arguments advanced by many writers advocating a return of letters of marque in order to combat new threats such as terrorism and piracy. See, e.g., DeWitte, supra note 26; Richard, supra note 19.

223 ADAMS, supra note 72, at 141.

224 See supra note 85.

225 Morse, supra note 83, at 659-60.

226 CHOATE, supra note 98.

227 The U.S. Navy, under Commodore George Dewey, destroyed the Spanish fleet at the Battle of Manila Bay on May 1, 1898. Spanish- American War, U.S. DEP'T OF NAVY-1898 NAVAL HISTORICAL CTR. (July. 15, 1996) http://www.history.navy.mil/faqs/stream/faq45-11.htm. Id. In July, 1898, Admiral William Sampson decimated the Spanish fleet off of Cuba. Id. "America emerged from the Spanish-American War as a major naval power." Id.

228 Tabarrok, supra note 21, at 575.

229 PARIS DECLARATION, supra note 63, at 64.

230 See Rita, 89 F. 763, 768 (1898); BARCLAY, supra note 27, at 205; Richard, supra note 19, at 429-30.

231 Council of Europe, Convention on Cybercrime, Nov. 23, 2001, E.T.S. No. 185, S. Treaty Doc. No. 108-11, 2001 WL 34368783, 41 I.L.M. 282 [hereinafter Cybercrime Convention].

232 COUNCIL OF EUROPE CONVENTION ON CYBERCRIME, http://www.conventions.coe.int/Treaty/Commun/ChercheSig.asp?NT=185 &CM=8&DF=23/01/2013&CL=ENG. (last visited Feb. 21, 2013) (providing chart displaying signatures and ratifications by specific countries).

233 Id.

234 Cybercrime Convention, supra note 231, at pmbl.

235 Sara L. Marler, The Convention on Cyber-Crime: Should the United States Ratify?, 37 NEW ENG. L. REV. 183, 196 (2002).

236 Bardin, supra note 13.

237 What may be legal in one country, may not be in another, thus creating law enforcement problems when trying to enforce any laws in cyberspace. Nancy E. Marion, The Council of Europe's Cyber Crime Treaty: An Exercise in Symbolic Legislation, 4 INT'L J. CYBER CRIMINOLOGY 699, 700 (2010).

238 For example, the two creators of the infamous ILOVEYOU virus in the Philippines were never charged as that country had enacted no laws prohibiting their acts. Wayne Arnold, Philippines to Drop Charges on E- Mail Virus, N.Y. TIMES, Aug. 22, 2000, http://www.nytimes.com/2000/08/ 22/business/technology-philippines-to-drop-charges-on-e-mail-virus.html. This one virus caused an estimated $10 billion in damage. Paul Festa & Joe Wilcox, Experts Estimate Damages in the Billions for Bug, CNET NEWS (May 5, 2000, 1:55 PM), http://news.cnet.com/Experts-estimate-damages- in-the-billions-for-bug/2100-1001_3-240112.html.

239 Marion, supra note 237, at 701.

240 Id.

241 Id. at 701-02.

242 MICHAEL A. VATIS, PROCEEDINGS OF A WORKSHOP ON DETERRING CYBERATTACKS: INFORMING STRATEGIES AND DEVELOPING OPTIONS FOR U.S. POLICY 207, 214 (2010); Cybercrime Convention, supra note 232, art. 24.

243 See, e.g., id. arts. 24-29.

244 See VATIS, supra note 242, at 214-18 (discussing the numerous loopholes contained in the Cybercrime Convention); Cybercrime Convention, supra note 231, art. 24.

245 Cybercrime Convention, supra note 231, art. 25.

246 This provision, in effect, means that if the information leads to more criminals, and a nation wants to prosecute them, it may not use this information in that investigation/prosecution. The nation must start over in the investigative process as it relates to the newly discovered bad actors. Id. art. 28.

247 Id. art. 27.

248 VATIS, supra note 242, at 219 (quoting Council of Europe Committee of Experts on Terrorism (CODEXTER), Opinion of the Committee of Experts on Terrorism (CODEXTER) for the Attention of the Committee of Ministers on Cyber terrorism and Use of Internet for Terrorist Purposes).

249 Ellen Nakashima, More Than 75,000 Computer Systems Hacked in One of Largest Cyber Attacks, Security Firm Says, WASH POST, Feb. 18, 2010, http://www.washingtonpost.com/wp-dyn/content/article/2010/02/17/AR20 10021705816.html.

250 Id.

251 VATIS, supra note 242, at 209 (quoting an unnamed U.S. Dep't of Justice official).

252 As Bardin states:

Do we really think that establishing a convention on cyber crime is going to stop our adversaries? They do not recognize our virtual boards or virtual sovereignty as it is. Why would they recognize a convention on cyber crime? All this does is force offensive cyber forces to establish an unwieldy 'rules of engagement' that ties the hands of those who can execute offensive cyber actions.

Bardin, supra note 13.

253 Id. ch. II, art. 2.

254 Id. art. 3.

255 Id. ch. II, art. 6.

256 Statement of Alberto Gonzales, Attorney General for the U.S., on the Passage of the Cybercrime Convention (Aug. 4, 2006), available at http:// www.justice.gov/opa/pr/2006/August/06_ag_499.html) (emphasis added).

257 Whether it is a congressional sub-committee, the NSA, DHS, etc.

258 Westby, supra note 147 (quoting Dave Dittrich, one of the first cybersecurity experts to explore the concept of active defense).

259 Id.

260 Richard, supra note 19, at 455.

261 Id. at 456.

262 An Act Concerning Letters of Marque, Prizes, and Prize Goods, Ch. 107, § 9, 2 Stat. 759, 761 (1812).

263 Tabarrok, supra note 21, at 575, 570.

264 See, e.g., America's Top Cyberwarrior Says Cyberattacks Cost $250 Billion a Year, INT'L BUS. TIMES, July 13, 2012, http://www.ibtimes.com/ americas-top-cyberwarrior-says-cyberattacks-cost-250-billion-year-72255 9; BRIAN CASHELL, WILLIAM D. JACKSON, MARK JICKLING & BAIRD WEBEL, THE ECONOMIC IMPACT OF CYBER-ATTACKS (2004), available at http://www.cisco.com/warp/public/779/govtaffairs/images/CRS_Cyber_Att acks.pdf.

265 COMMONWEALTH SECRETARIAT, LAW IN CYBERSPACE 23 (2001); Consumers Association of Singapore, CASETRUST.ORG, http://www.case- trust.org.sg/ (last visited Feb. 1, 2013).

266 Ch. 107, § 9, 2 Stat., at 761.

267 See, e.g., Andy Greenberg, Stealthy Government Contractor Monitors U.S. Internet Providers, Worked with Wikileaks Informant, FORBES, Aug. 1, 2010, http://www.forbes.com/sites/firewall/2010/08/01/stealthy-gov- ernment-contractor-monitors-u-s-internet-providers-says-it-employed-wiki leaks-informant/.

268 See, e.g., Robert McFarvey, Threat of the Week: Corporate Credit Unions Should Bolster Defenses Against DDoS, CREDIT UNION TIMES, Jan. 22, 2013, http://www.cutimes.com/2013/01/22/threat-of-the-week-corpo- rate-credit-unions-should?ref=hp.

269 See D. Joshua Staub, Letters of Marque: A Short-Term Solution to an Age Old Problem, 40 J. MAR. L. & COM. 261, 265 (2009); Richard, supra note 19, at 464 (proposing that letters of marque be used to deal with Somali piracy in both defensive and offensive roles).

270 See Zach, Steven Chabinsky (Crowdstrike, Ex-FBI Cyber Division) Talks Private Sector Cyberdeterrence at ABA's Natsec Law Conference, CYBER SECURITY L. & POL'Y (Nov. 30, 2012), http://blog.cyber- securitylaw.us/2012/11/30/steven-chabinsky-crowdstrike-ex-fbi-cyber-division-talks-pprivate-sector-cyberdeterrence-at-abas-natsec-law-conference/.

271 Brenner, supra note 212.

272 See., e.g., Commissioning Private Vessels for Seizure of Piratical Vessels, 33 U.S.C. § 386 (2006).

The President is authorized to instruct the commanders of the public armed vessels of the United States, and to authorized the commanders of any other armed vessels sailing under the authority of any letters of marquee and reprisal granted by Congress, or the commanders of any other suitable vessels, to subdue, seize, take, and, if on the high seas, to send into any port of the United States, any vessel or boat built, purchased, fitted out, or held as mentions in 33 U.S.C. § 385.

Id.

273 Tabarrok, supra note 21, at 572.

274 Jurisdiction, 10 U.S.C. § 7652 (2006).

275 See The Resolution, 2 U.S. 19 (U.S. 1781) (holding that the burden of proving a prize was captured lawfully lies with the captors).

276 The legality of a capture is not determined until a court of competent jurisdiction has issued an order making such a determination. Id. Whether property seized may be confiscated as a prize is a judicial question and each case is to be decided on its own facts. Property Captured by the Potomac Flotilla, 10 Op. Att'y Gen. 467 (1863).

277 Duties of United States Attorney, 10 U.S.C.A. § 7656 (2012).

278 Tabarrok, supra note 21, at 568.

279 The United States paid the owners of the captured ship $11,000 in damages. PETRIE, supra note 122, at 160.

280 See, e.g., In re The Amiable Isabella, Munos, 19 U.S. 1 (1821); The Adeline, 9 Cranch 244 (1815); The Amy Warwick, 67 U.S. 635 (1862).

281 Brenner, supra note 212.

282 Richard, supra note 19, at 455.

283 In a cyber context, this could include all computers and network capabilities.

284 48 C.F.R. §§ 9.406-406-05, (2012).

285 See The Santissima Trinidad, 20 U.S. 283 (1822) (holding that illegal privateers, whether public or private, "are tortuous-and the original owner is entitled to restitution when brought within our jurisdiction"). Tort liability has real teeth, as government is generally immune from civil suit, whereas a letter of marque holder would not be. See David A. Sklansky, The Private Police, 46 UCLA L. REV. 1165, 1186 (1999); Richard, supra note 19, at 455.

286 See supra Part II.

287 UPTON, supra note 57, at 180.

288 Id. at 487.

289 MACLAY, supra note 25, at xxiv (discussing privateers running from or surrendering to friendly ships because they believed them to be enemy warships or even firing on friendly ships due to lack of positive identification and communication).

290 Similar cyber threat and intelligence information-gathering authority is vested in the Secretary of Homeland Security. See Exec. Order No. 13,636, 78 Fed. Reg. 11,739 (Feb. 19, 2013).

291 This cooperation is not without historical precedence. Between 1739 and 1763, privateers worked with the British Navy in capacities ranging from troop transportation to blockading enemy ports. See JAMES G. LYDON, PIRATES, PRIVATEERS, AND PROFITS 25, 136, 132 (1970); but see Marshall, supra note 24 (arguing that privateers were incompetent and responsible for several failures during the Revolutionary War). Marshall dismisses, almost out of hand, the evidence to the contrary discussed by MACLAY, supra note 25, at 214-15, and Lobel, supra note 25, at 1044.

292 William J. Lynn, III, The Pentagon's Cyberstrategy, One Year Later, FOREIGN AFF. (Sept. 28, 2011), http://www.foreignaffairs.com/ articles/68305/william-j-lynn-iii/the-pentagons-cyberstrategy-one-year- later.

293 Matt Egan, Hack the Hackers? Companies Itching to Go on Cyber Offense, FOX BUS. (Dec. 7, 2012), http://www.foxbusiness.com/technology 2012/12/07/hack-hackers-companies-itching-to-go-on-cyber-offense/#ixzzz 2EWE5mlfa.

294 Id. (quoting testimony of former Homeland Security adviser and Director of George Washington University'sHomeland Security Policy Institute, Frank Cilluffo).

295 U.S. AIR FORCE LIFE CYCLE MGMT. CTR., BAA ESC 12-0011, BROAD AGENCY ANNOUNCEMENT: CYBERSPACE WARFARE OPERATIONS CAPABILITIES (2012), available at http://fbp/gov/utils/view?id=48a4eeb344 432c3c87df0594068dc0ce.

296 DEF. ADVANCED RES. PROJECTS AGENCY, DARPA-BAA-13-02, BROAD AGENCY ANNOUNCEMENT: FOUNDATIONAL CYBERWARFARE (PLAN X) (2012), available at https://www.fbo.gov/index?s=opportunity&mode= form&id=1bc45a18e1ba0763640824679d331e46&tab=core&_cview=0.

297 See supra Part IV (discussing Computer Fraud and Abuse Act, 18 U.S.C. § 1030(c) (2006), which allows for up to twenty years imprisonment for violations of the law).

298 Chris Strohm, Tax Breaks Considered to Improve Cybersecurity on Vital Neworks, BUS. WEEK, (Feb. 12, 2012), http://www.businessweek.com/ news/2012-02-14/tax-breaks-considered-to-improve-cybersecurity-on-vital -networks.html.

299 William J. Lynn III, Defending a New Domain: The Pentagon's Cyberstrategy, FOREIGN AFF., Sept.-Oct. 2010, http://www.foreignaffairs. com/articles/66552/william-j-lynn-iii/defending-a-new-domain.

300 "Historian Faye M. Kert offers the judgment that 'without the presence of the American privateers in the Revolutionary War and the War of 1812, the United States would never have been able to hold off the British Navy.'" SECHREST, supra note 31, at 7.

301 See infra Part III.

302 This addresses the emotional and intellectually dishonest reactions of "vigilante justice in cyberspace . . . notions of pirates on the high seas and wild west posses" as voiced by people such as Jim Richards of Tangent Capital. Egan, supra note 293.

303 Some complain that to allow active-defense, cyberspace would devolve into a "wild west." ("Allowing companies an exception to the CFAA really would turn the Internet into the Wild West."). Westby, supra note 147.

It is in many ways the Wild West. Cyberspace has many similarities to a Wild West world . . . The message of this metaphor for cyberspace security is clear: If there is no way to enforce law and order throughout all of cyberspace, which appears to be the case, one must rely on local enclaves of law and order, and trusted friends.

RICHARD O. HUNDLEY & ROBERT H. ANDERSON, EMERGING CHALLENGE SECURITY AND SAFETY IN CYBERSPACE 12, reprinted from IEEE TECHNOLOGY AND SOCIETY MAGAZINE (1995/1996). International scholars have also recognized the Wild West nature of the internet. See Richard de Silva, Cyber Law: Navigating the Legalities of Digital Weapons, CYBER DEF. & NETWORK SECURITY, Oct. 2012.

304 "'It's unfair that hackers can do whatever they want and companies have to follow rules . . . .' said Ronen Kenig, director of security product marketing at Radware." Egan, supra note 293.

Major Christopher M. Kessinger*

* U.S. Army, Judge Advocate. Presently assigned as Administrative Law Attorney, Administrative Law Division, Office of The Judge Advocate General, U.S. Army.

Copyright:	(c) 2013 Superintendent of Documents
Wordcount:	16636