r/blackhat • u/wohgol • 11d ago
Hypothetically, how likely is the DOJ to prosecute a U.S. citizen for ransomware against a foreign adversary?
EDIT: Reading comprehension in this sub is at rock bottom levels. Please read the following post prior to commenting.
Hello everyone. I have a completely hypothetical question that I have been debating with friends. Due to strong arguments both for and against without a clear consensus, I feel it may be beyond our expertise as armchair lawyers and as such, I am pleased to present this to the greater community.
While this is a broad hypothetical, there are a few specific details that must be outlined for the sake of the argument:
\- The victim would be a clear, undeniable foreign adversary/hostile nation to the US
\- There is no direct conflict with or collateral damage to US interests or allies(as a result of the ransomware being deployed)
\- The individual would meticulously report all income from the ransomware payouts on Schedule 1, Line 8z of the IRS Form 1040, pleading the Fifth Amendment on the source of the income, and then pay their 37% top marginal tax rate(They make sure to pay Uncle Sam his cut and avoid committing tax fraud/evasion).
That being said, I want to note: I am **NOT** asking if the frameworks and legal statues to charge a person for this exist. They absolutely do.
The question is if the US citizen would be prosecuted and/or convicted if the victim is unable/unwilling to cooperate with a US court, there is no conflict with US interests, and they even pay taxes on the income.
Thanks and looking forward to any and all answers!
Disclaimer: Do not attempt this at home. Side effects may range from blacked out SUV’s parked outside your house to being arrested/murdered by a foreign intelligence service.
•
u/Chongulator 11d ago
Random citizens going after their government's adversaries can have all sorts of negative knock-on effects.
A few off the top of my head:
- Perhaps the perceived adversary is actually an ally in some respect.
- The citizen could burn a vulnerability which the government had been holding for something more serious.
- The attack could create a diplomatic incident.
- The attack could trigger reprisals, even very serious reprisals, against the vigilante's fellow-citizens.
- The attack could trigger security review of the adversary's other targets.
•
u/wohgol 11d ago
Honestly I think that for someone who isn’t a complete buttery smoothbrain, accidentally burning a vulnerability is the worst case scenario because that directly brings you into conflict with US interests and gives the security community a very clear and exact reason for wanting you to, uh, knock it off.
I think that the hypothetical citizen would do itself a favor by spending an inordinate amount of time discerning between whether or not a potential target for them could also be a potential target for national security interests, and make every effort to avoid that collision.
•
u/Chongulator 11d ago
To me, even considering it is folly.
The vigilante makes themselves look like a legitimate military target to the foreign adversary, and opens themselves up to serious legal consequences at home for damaging US interests.
Besides, do we have any reason to doubt the capabilities of TAO and other cyber-offense elements of the government?
•
u/wohgol 11d ago
Serious legal consequences at home?
Buddy that is literally what the post addresses and the question I am here to answer.
What legal consequences? (see original post for context)
•
u/Chongulator 11d ago
The crux of the matter is the vigilante has no way of knowing whether their action would interfere with US interests. They simply don't have access to the right information.
It used to be that prosecutions involving classified information would often be dropped because the government didn't want the classified information to become public record. The Classified Information Procedures Act now provides a framework to bring those cases while still protecting the classified info.
A foreign victim is unlikely to have standing in a US court. If criminal charges are brought against the vigilante, to the extent there is a victim at all, that victim is the US and US interests, not the target of the attack.
•
u/mfraziertw 8d ago
If the attack did enough damage I could see China or Russia doing reverse prisoner swap. Hand over someone the US wants in exchange for you. Or I mean your friend. Or the hypothetical person in the scenario.
•
u/-Crash_Override- 11d ago
'Hypothetically'
•
u/wohgol 11d ago
You know, I had a thought the other day that most OPSEC tooling and strategy is typically designed to avoid the watchful eye of Uncle Sam(whether or not the creators explicitly state that).
Now, this is not me diminishing how hypothetical this question is, because it is completely hypothetical, but it’s kinda funny to imagine deploying ransomware, only using a fraction of the defensive posture you’d want to have if you were attacking US companies, getting paid for it, and not being paranoid about the alphabet boys finding you(because you report the income and pay taxes on it).
•
u/1_________________11 11d ago
Cfaa says 30 years straight to jail.
•
u/Chongulator 11d ago
No, no, OP is really smart and can figure out what the entire US intelligence community is up to. He'll never get caught! We just aren't smart enough to understand how wily he is. 😜
•
u/wohgol 11d ago
No, you(specifidally) are unfortunately not smart enough to just read the original post, where I addressed every point you made before you made them. Which you would know. If you had read the post.
•
u/I-cant_even 10d ago
Dude, if you think that the feds won't see this post you're naive. I hope this is literally a hypothetical otherwise you're in FAFO land.
•
u/MoldavskyEDU 11d ago
100%.
This program only applies to certified companies not individuals, and also only foreign hacking groups not governments.
•
u/THIS_IS_NOT_DOG 11d ago
There is no Geneva convention regarding this.
•
u/DisastrousRun8435 8d ago
That’s not an issue. He’d probably get prosecuted as a civilian. Ransomware implies that it’s basically a robbery
•
u/United_Branch_5736 10d ago
You're a U.S. citizen. You committed a federal crime. The DOJ has jurisdiction, they have the statutes, and they have the motivation. The only question is whether they find out. And in 2026, with blockchain tracing, digital forensics, and international cooperation? They will.
As someone pushing 60? Who spent entire life in IT? Hipoteticly? Todays adversery is tomorrow's friend. And enemies are not always the ones you see broadcasted on TV. Don't play with fire.
•
u/0xdade 1507 Systems; 1 Day. 10d ago
Criminal charges are not brought forth by the victim and the DOJ can make a plenty compelling case without victim cooperation, provided they have evidence that would warrant bringing a case in the first place (which is necessary for the premise of this question).
I suspect the answer to this question is wholly dependent on the administration at the time of action, as well as whether the person in question gets lucky or unlucky with being noticed by prosecutors. It could quickly become an act of diplomacy for our justice system to punish someone for acts against an adversary as a show of good will or some other political bargaining chip.
The answer also likely depends on whether or not this hypothetical action impacts an allied intelligence operation, which the person doing the ransomware cannot possibly know ahead of time. If an ally is like “our op got burned because Joe Cool from Montana wanted to play ransomware cowboy” then Joe Cool is probably going to jail.
•
u/I-cant_even 10d ago
Could be a violation of sanctions to receive funds from the country for any reason though.
•
u/I-cant_even 10d ago
Okay, I'll bite.
> \- There is no direct conflict with or collateral damage to US interests or allies(as a result of the ransomware being deployed)
This is where you fucked up. You have *NO IDEA* what US interests are or are not. In some scenarios you become a bargaining chip to trade for things the US cares about. Any attack that is potentially traceable to the US will piss a lot of people off at the state department and the "state" department.
•
u/wohgol 10d ago
Russian and Chinese hackers target the US with impunity. They see zero consequences for it in their home countries. The US will try to arrest them in other countries sure, but as long as they stay within their borders and as long as they don’t target anyone domestic, they might as well be working a 9-5 as far as their government is concerned.
I also know I disagree a lot in this thread, but I feel like it doesn’t take a genius to figure out that a small hardware retailer or something of similarly unimportant statue is an actively watched target, or even something that the security community would care about.
•
u/I-cant_even 10d ago
The US is *not* Russia or China. Also there's a difference between state sanctioned hackers and unsanctioned hackers. Unsanctioned don't get protected by Russia and China like you think they do.
•
u/wohgol 10d ago
Cite one example of either Russia, China, or the US prosecuting one of their citizens for cyber crimes that weren’t against their own or an allied country.
Pro Tip Edit: Good luck, because the one example does not exist.
•
u/I-cant_even 10d ago
Dude, you're misreading me, I'm saying the hackers just fucking disappear. Russia/China have no problem with summary execution, the issue is that an unsanctioned hack coming from a US citizen may lead to the US government turning a blind eye on the hackers disappearance.
There are a lot of people that just disappeared without a trace and no one knows why. One more doesn't matter to the public but the people in the correct circles see the message about not playing stupid games.
•
u/wohgol 10d ago
Seems like a couple of the other suspiciously aggressive comments on this post, where the user vaguely suggest that the other government will murder me and/or my family.
To that I reply, thank god I live in the greatest country on earth where I am allowed to own a Glock with a couple 50 round magazines and an FRT trigger. FAFO, right?
•
u/I-cant_even 10d ago
So, this IS NOT a hypothetical? This reddit account is on a burner email behind a non-front VPN right?
I wish you and yours the best. May your guns and triggers protect you from the repercussions of your actions.
•
u/wohgol 10d ago
I don’t know myself at this point, but I do know if it were real, I’d wish on a shooting star that a motherfucker would try something 😤 (unless that motherfucker was the us government, in which case I would apologize profusely and promise to be a good noodle and a gold star from then on)
•
u/TheDoc4206969 10d ago
Bro’s out here doing the CIA’s job for free? Did Kim personally piss you off or something?
•
•
u/Double-Familiar 10d ago
No, a US citizen would not be prosecuted.
How would the victim of the ransom ware reach out to the U S. government and know the identity of who compromised them? The foreign adversary would have quite a challenge identifying the attacker.
An example could be how the US charges Russian, Chinese, and North Korean government hackers in absentia. They know the identity of some of the foreign nation state hackers. They also know that those countries would never turn over their own talent to stand trial in the U.S.
No extradition treaties as well? I think that the likelihood of prosecution is very very low.
•
•
u/bombastic6339locks 11d ago
I'd rather just move to countries that are more lenient on that, like move to china/russia (israel xd), make a company there and start doing that.
•
u/pondy12 11d ago
this reddit post is going to end up in a doj indictment lmao