The Special Operator Protection Act of 2026 adds a new section to Title 18 that criminalizes making specific categories of personal information about special operations personnel—or their immediate family—publicly available when done to threaten, intimidate, or facilitate violence. The bill defines who counts as a covered person, what counts as restricted personal information, and applies mens rea requirements before criminal liability attaches.
This matters for defense officials, service members, online platforms, investigative journalists, and civil liberties practitioners. The measure creates a federal tool aimed at deterring doxing of high-risk military and associated law enforcement personnel, but it also raises questions about how intent will be proven, how public records are treated, and how platforms should respond to reposted material.
At a Glance
What It Does
The bill creates a new federal offense that makes it unlawful to knowingly make 'restricted personal information' about covered special-operations personnel or their immediate family publicly available with the intent to threaten or intimidate, or with the intent and knowledge that the information will be used to facilitate a violent crime. It enumerates categories of protected data and ties coverage to a Secretary of Defense designation for certain DoD personnel.
Who It Affects
Covered persons include members of U.S. special operations forces, DoD employees or service members designated by the Secretary of Defense who perform 'sensitive activities' under 10 U.S.C. §130g, and federal law enforcement attached to SOF. Secondary actors affected include online platforms that host reposted material, reporters and OSINT researchers who handle public records, and immediate family members identified by the statute.
Why It Matters
The statute fills a targeted gap by making certain doxing conduct criminal at the federal level rather than leaving deterrence to platform policies or scattered state laws. It will shift enforcement and compliance questions toward federal prosecutors and platform moderation teams, and it raises First Amendment and evidentiary issues about intent and the handling of publicly available information.
More articles like this one.
A weekly email with all the latest developments on this topic.
What This Bill Actually Does
The Act inserts a new §120 into Chapter 7 of Title 18. That section starts by listing who the law is meant to protect: active special operations forces personnel, certain DoD employees or service members the Secretary of Defense designates because they perform 'sensitive activities,' and federal law enforcement assigned to or working with special operations forces.
The statute also imports definitions from existing federal law for terms like 'crime of violence' and 'immediate family.'
It then defines a closed set of 'restricted personal information.' The list includes a person’s name tied to their place of employment, photos of their face linked to their name and employer, images of their home tied to their identity and employer, standard personal identifiers like date of birth, Social Security number, private phone numbers and emails, and biometric data. The bill makes clear that the protected information is not any random data about a person but specific categories tied to identity and location.The criminal rule has two alternative mental-state pathways.
One pathway requires that the defendant made the restricted information public 'with the intent to threaten, intimidate, or incite the commission of a crime of violence.' The other pathway criminalizes making the information public 'with the intent and knowledge' that it will be used to threaten, intimidate, or facilitate a violent crime. The statute therefore ties liability to purposeful conduct rather than merely negligent or reckless sharing.Penalty structures are tiered: general violations carry fines and up to five years in prison; if the dissemination leads to death or serious bodily injury, the statute authorizes fines and any term of years or life imprisonment.
The bill does not create a civil private right of action, does not amend platform liability rules such as Section 230, and does not include express reporting or takedown procedures — its mechanism is purely criminal enforcement by the federal government.
The Five Things You Need to Know
The bill defines 'restricted personal information' to include a person’s name tied to their place of employment, visual depictions of their face or home when linked to name and employer, personal identifiers (DOB, SSN), contact details, and biometric data.
Liability requires a culpable mental state: either intent to threaten/intimidate/incite violence or intent plus knowledge that the information will be used to facilitate a crime of violence.
Covered persons extend beyond uniformed SOF: the Secretary of Defense can designate DoD employees or service members who conduct 'sensitive activities' under 10 U.S.C. §130g, and it includes federal law enforcement attached to SOF.
General offenses carry up to 5 years imprisonment; if death or serious bodily injury results from the disclosure, the statute allows any term of years or life imprisonment.
The statute targets public dissemination but contains no civil remedy, no platform safe-harbor language, and no explicit exemption for reporting or republishing material already in public records.
Section-by-Section Breakdown
Every bill we cover gets an analysis of its key sections.
Short title
Designates the act as the 'Special Operator Protection Act of 2026.' This is purely titular but signals congressional intent to frame the measure as tailored protection for a narrow category of national-security personnel, which may guide interpretation in enforcement and litigation.
Who is protected and what data is restricted
Establishes 'covered person' categories: (A) members of special operations forces; (B) DoD employees or service members the Secretary designates who perform duties labeled 'sensitive activities' in 10 U.S.C. §130g; and (C) federal law enforcement attached to SOF. It defines 'restricted personal information' across six concrete buckets (name + employer, facial likeness tied to name/employer, home imagery tied to name/employer, core identifiers and contact info, and biometric data). These concrete categories narrow the statute’s reach compared with a free-form 'personal data' definition, but leave open questions about how linkage (e.g., 'in connection with') will be proven.
When making information public is a federal crime
Creates two alternative culpable states that trigger criminal liability: knowingly making restricted information public with (1) intent to threaten/intimidate/incite a crime of violence, or (2) intent and knowledge that the information will be used to threaten, intimidate, or facilitate a crime of violence. The bill thus requires purposeful conduct; mere republication without the specified intent or knowledge is not criminal under this text. Prosecutors will need to prove subjective intent or knowledge, which shifts the case law and fact-gathering burden toward demonstrating motive, communications, or coordinated behavior.
Criminal penalties tied to harm
Sets penalties for violations: up to 5 years imprisonment and fines for ordinary violations; if the violation results in death or serious bodily injury, penalties escalate to fines and any term of years or life imprisonment. The statute therefore contemplates causation between the publication and the resulting harm; courts will confront evidentiary issues proving that the disclosure materially led to the violent outcome.
Table of sections updated
Adds §120 to the table of sections for Chapter 7 of Title 18. This is a mechanical step that allows the new offense to appear in statutory indexes and codified references but does not change substance.
This bill is one of many.
Codify tracks hundreds of bills on Defense across all five countries.
Explore Defense in Codify Search →Who Benefits and Who Bears the Cost
Every bill creates winners and losers. Here's who stands to gain and who bears the cost.
Who Benefits
- Members of U.S. special operations forces — the statute criminalizes targeted public disclosures tied to their identity or home that are intended to facilitate violence, creating an additional federal deterrent and an enforcement mechanism tailored to operational risk.
- Immediate family members of covered personnel — family contact information and home imagery get the same statutory protection; the law recognizes that threats often move from service members to their households.
- Department of Defense and mission planners — by criminalizing malicious disclosure of certain categories of personal data, the statute underwrites operational security and may reduce the operational costs associated with reactive protective measures for personnel.
- Federal law enforcement attached to SOF — protections extend to agents and officers embedded with special operations, helping secure whole-unit operations and interagency collaborators.
Who Bears the Cost
- Online platforms and social media companies — they may face increased takedown requests and operational costs to triage alleged violations, although the bill does not impose a civil liability or a statutory takedown regime.
- Journalists, OSINT researchers, and academic investigators — the criminal prohibition on publicizing certain linked information raises the risk that legitimate reporting or analysis could stray into prohibited conduct absent clear exemptions or safe harbors.
- Open-source intelligence and hobbyist communities — individuals who compile or repost geolocated imagery or employment-linked data will confront greater legal uncertainty and potential criminal exposure when material relates to covered persons.
- Federal prosecutors and courts — proving intent and causation will require investigative resources and novel legal arguments, increasing evidentiary and resource burdens in enforcement.
Key Issues
The Core Tension
The central tension is between protecting the safety and operational security of special-operations personnel and preserving robust public discourse and investigative activity: the bill criminalizes malicious dissemination of tightly defined personal data, which deters targeted attacks, but its lack of clear exemptions for public records or reporting risks chilling legitimate journalism and OSINT work and raises difficult proof and enforcement questions about intent and causation.
The statute threads a narrow criminal needle by tying liability to specific categories of data and to intent or intent-plus-knowledge, but that construction creates difficult implementation questions. 'In connection with the individual’s place of employment' is a factual phrase that may sweep in widely available reporting (for example, a photo caption that mentions a unit), and courts will need to resolve how close the linkage must be. Similarly, 'publicly available' is not qualified: the bill criminalizes republication of restricted information even if the material originally entered the public domain through government records or prior reporting.
That omission creates possible conflicts between public-record access and the statute’s protective aim.
Proving the statute’s mens rea elements will be the central practical hurdle for prosecutors and the main defense lever for defendants. The law requires proof of subjective intent or knowledge that the information will be used to facilitate violence — facts that typically rest on contextual evidence (messages, coordination, prior threats).
This focus lowers the chance of sweeping criminalization but leaves victims with limited immediate remedies: the bill creates no civil cause of action and no administrative takedown process, so relief from continuing online exposure still depends on platform policies, state remedies, or separate statutory authorities. Finally, the statute does not address extraterritorial or classified-information tensions; prosecutions could raise separation-of-powers or First Amendment challenges if they touch on matters of public concern or rely on classified designations tied to 'sensitive activities.'
Try it yourself.
Ask a question in plain English, or pick a topic below. Results in seconds.