The U.S. Congress and government have recently examined measures to respond to cyber‑crime, focusing on expanding the role of private companies.

The “Cybersecurity Authorization Act” proposed by former CFTC Chair Chris Johnson contains provisions that allow private parties to directly intervene after tracking hackers and seizing their assets.

In the first briefing, Johnson, through a joint statement released on February 26, 2025, defined the Lazarus Group hacking incident as a national threat and proposed granting government authority to private entities for “hacker tracking and asset seizure.”

The second briefing describes how the FBI in August 2025, H.R. 4988, expanded the scope of cyber‑crime and sought to include foreign governments in criminal organization definitions. This bill cites “asset seizing” as a case study and proposes specific measures. However, this bill is still under review by the House Foreign Affairs Committee, and it has not yet decided whether private entities can be authorized or granted hacker authority.

In the third briefing, Secretary of Defense James Mattis issued a memo on August 12, 2026, directing that U.S. companies operating under the direction and supervision of the federal government should develop programs to monitor U.S. firms’ compliance with cyber‑crime regulations. The memo does not identify Lazarus Group specifically, nor does it include provisions allowing private entities to directly intervene in hacker actions.

Fourthly, active private sector response to hacking uses technology and capabilities but may raise third‑party harm, retaliation, and foreign policy concerns. U.S. Congress’s “Cybersecurity Reform Act” (CRS) notes that if the attacking party is not identified properly, a rogue third party could suffer damage, and that domestic organization responses could become retaliation or foreign policy issues.

Overall, the actions taken by the U.S. so far are largely preventive measures such as FBI’s request for trade data, bills in Congress, and Secretary Mattis’ direction. The concrete approval of private companies to conduct hacking is not yet clear, but “Cybersecurity Authorization Act”‑style authority exists, though its practical application remains uncertain.