International cyber piracy is a growing threat to personal, economic, and national security. But it is not a new threat, not in essence. In the basic character of the problem that it poses to law-abiding citizens of civilized nations, piracy of intellectual resources over the Internet is the same as piracy of ships and cargo on the high seas. Both are actions of trespass and theft beyond the reach of the legal institutions that protect the victims. Like the Barbary pirates of old, cyber pirates often live in sovereign states that fail to remedy or sanction their wrongs.

The Constitution of the United States declares a remedy for piracy. It empowers Congress to issue letters of marque and reprisal. These are private commissions which authorize a person to seize the property of a foreign wrongdoer, whose host nation will neither hold the wrongdoer accountable nor make the victim whole. A couple of scholars and a handful of law students and military officers have suggested that Congress should revive that moribund clause and commission counter-hackers to go after pirates overseas. The idea has not yet caught on. Perhaps that is because the Reprisal Clause has a bad reputation in law and jurisprudence. But its reputation follows from 19th century abuses of what was once a venerable and lawful commission. The commission itself should not be conflated with its later abjection.

The Uses and Abuses of Letters of Marque

To understand why the letter of marque and reprisal became the loose cannon of international law is to see how it can be refurbished and repurposed to solve one of the most formidable problems of our age, within the requirements of due process of law. In short, a private commission is lawful when used to reprise something of value that was taken in an act of wrongdoing, after the sovereign nation in which the wrongdoers take refuge refuses to remedy or sanction the wrong. The letter of marque went rogue when it was unmoored from the legal concept of reprisal and became a roving commission to capture resources belonging to others. By itself, the letter of marque can be a cause of international anarchy. But when tied to the legal concept of a reprisal, it is a just and lawful means to vindicate private rights across sovereign boundaries.

Letters of marque should be issued for particular reprisals alone. William Blackstone referred to the terms “marque” and “reprisal” as “words in themselves synonymous.” And both mentions of the device in the first article of the United States Constitution refer to letters of “marque and reprisal,” neither term appearing without the other.

When a letter of marque is issued for a justified reprisal, it can work in cyber space as it once worked on the oceans. “Reprisals are used between nation and nation,” Emer de Vattel taught, “in order to do themselves justice when they cannot otherwise obtain it.” The concept of a reprisal itself sometimes went wrong, as when it was used to rationalize vengeance killings. This explains its mistaken identification with lawless violence. But in the ius gentium—the law governing civilized nations—reprisals and seizures vindicated wrongs against property and followed conventional procedures for satisfying debts.

Vattel explained,

If a nation has taken possession of what belongs to another—if she refuses to repay a debt, to repair an injury, or to give adequate satisfaction—the latter may seize something belonging to the former and apply it to her own advantage till she obtains payment of what is due to her, together with interest and damages.

Vattel insisted that the law of nations allows reprisals “only upon evidently just grounds, or for a well-ascertained and undeniable debt.”

Only a sovereign who adjudicates the just grounds for a reprisal can order one. But a private citizen may obtain permission to make a reprisal by obtaining a letter of marque, a special commission that both empowers the privateer to obtain justice directly and obligates him to prove the justification in a subsequent prize action. The requirements of obtaining a letter and of proving cause for its execution are necessary, Blackstone explained, “else every private sufferer would be a judge in his own cause.”

In English law, the power to issue private commissions was within the executive’s prerogative. The framers of the United States Constitution relocated the power to the legislative branch. And the Constitution prohibits the states from issuing letters of marque and reprisal, reserving it to Congress. The power to adjudicate cause belongs to courts of admiralty, though that assignment is a custom derived from the commission’s maritime history, not an express constitutional mandate.

The practice of privateering fell into disfavor in the 19th century after nations began to abuse it. Rather than issue a letter of marque only to remedy a particular wrong, sovereign states started issuing general letters, commissioning privateers to capture ships flying the flags of other sovereign states, sometimes without cause. As a result, it became difficult to tell the difference between a reprisal and an act of state-sanctioned piracy.

Western nations met in Paris in 1856 to end the practice of privateering. The resulting agreement secured the conditions necessary for free trade during the industrial revolution. Each nation needed assurances from the others that they would not harass commercial shipping, nor blockade ports, except as justified acts of war. They could have accomplished the same end by limiting issuance of private commissions to cases of reprisal for particular wrongs, documented by competent evidence. But in light of the then-recent history of abuses, an outright ban was a sensible solution.

Reviving Reprisal 

The United States is not a party to the Paris Declaration of 1856. And the Reprisal Clause of Article One still declares a live power of Congress. The legal foundations for issuing letters of marque are in place, should we choose to use them in traditional or new contexts. The chief obstacle to commissioning privateer counter-pirates is inertia. The task would be to fashion criteria and procedures to ensure that letters of marque are issued only for justified reprisals.

Though the contexts are novel, it is not difficult to identify cyber piracy when we see it. Hackers steal trade secrets and other valuable innovations from American companies, just as ocean-going pirates seize ships carrying valuable cargo. They hold personal data hostage, just as pirates demand ransom payments for the return of kidnapped persons.

Letters of marque could authorize counter-hackers to engage in different levels of investigation of and reprisal for those wrongs, according to the case. A Navy officer has proposed three levels of authorized response, justified on different burdens of proof: (1) tracing back to the origin of an attack, (2) blockading a wrongdoer from Internet access, and (3) counterattacking to prevent repeat offenses. Other proposals that are more in keeping with the original meaning of the Reprisal Clause include seizing digital assets from the pirates until they disgorge their ill-gotten gains.

The chief difficulty is to identify justifications. These are contained in the customary law of wrongs. Most lawyers today are trained to think about legal justification by reference to statutes, administrative regulations, treaties, and judicial precedents. Those materials are useless when pirates enjoy the protection of foreign sovereigns who do not recognize our laws as their laws.

An original understanding of the term “reprisal” avoids this problem. When the Reprisal Clause was ratified, American lawyers thought of judicial opinions and positive enactments as declarations of law, not as the law itself. Now, as then, wrongdoing must be proven by reference to the natural and customary norms of the ius gentium. 

Officials who issue reprisal commissions and lawyers who adjudicate prize disputes must reason like lawyers of earlier generations, who were trained in the legal concepts of common law and international customary law. Hugo Grotius, the original authority on the law of reprisals, demonstrated that the authority of the ius gentium is not contingent upon the consent of any nation but is instead grounded in the authority of reason itself, which is given specific determinations by the conventions and tacit agreements of the people who utilize common resources.

The operative legal concepts justifying reprisals are property rights. The requisite fact is some act of unauthorized intrusion into resources that belong to another as a matter of both customary norms and natural justice. This is not a matter of sentiment or philosophical abstraction. As I show in a paper forthcoming in the journal IP Theory, a discrete set of familiar property concepts can account for the conventional norms that people expect others to honor when they entrust their valuable information to computer systems. Indeed, three concepts perform most of the necessary work.

The first is an idea familiar to both classical jurists and Internet users alike: a domain. A domain refers to the set of virtual resources that the owners and authorized users expect to be exclusive to the group and its collaborators. It is also an ancient jurisprudential term, referring to the locus within which a person or community of persons exercises dominion over some resources to cultivate them, make them productive, and use them to help themselves and others flourish.

That a person or group of persons has dominion over some space, whether tangible or virtual, entails that they have the right to determine the use and management of it. This, in turn, entails that their efforts to exclude meddlers from the domain and to license entry to those who seek cooperation are entitled to respect. The concept of a domain signals to those outside the domain that they have a natural duty to exclude themselves unless given consent to enter (or unless they are acting for an especially weighty reason, recognized in law as a justification, such as strict necessity to save a human life).

The second concept is a bailment. You create a bailment every time you send a letter in the mail or ship furniture to your new home, with the result that your bailee has a duty to deliver the goods as you direct and a derivative right to exclude everyone who is not you. You should also be presumed to create a bailment when you entrust your valuable data to a service provider.

The third concept is a license. You license entry to your home when you invite a guest to dinner. Your guest’s license is not a property right; it is contingent on the purposes for which you create it. The same principle governs licensed access to a computer system. A license shifts the presumption from exclusion to inclusion with respect to the licensee, but that presumption can be overcome with evidence that the entrant exceeded the scope of the license or violated its express or implied terms.

The law of cyberspace is not rocket science. It’s not even legal science. As Judge Easterbrook observed more than two decades ago, it is simply law.

The framers of our national Constitution might have been surprised by the Internet. But they would not have been surprised to discover that the laws whose terms they declared in that instrument are capable of meeting the challenges of the information age. Most of those challenges are not new. Pirates are still piratical. And just reprisals are still a lawful way to bring them to justice.