3 ms·
It’s an interesting idea, but not without its challenges. This jumped out at me: > Though letters of marque have fallen out of favor, the intent they represent
by lurk2 2y ago
It’s an interesting idea, but not without its challenges. This jumped out at me:
> Though letters of marque have fallen out of favor, the intent they represent is still valid. Their use allowed the government to outsource defense of military and economic interests to those willing and able to defend themselves and/or others.
Decentralizing measures like this can be an effective means of dealing with security threats, but they have destabilizing effects in the long run. There are two examples from South America, both being quite similar: Colombia in the 1990s and Mexico in the 2010s. In both countries, you see militia organizations (autodefensas - literally “self-defenders”) emerging to counter the influence of organized crime. These organizations initially come about organically. In Colombia, the militias are eventually endorsed by the government, and in Mexico attempts are made to regulate them. As the civil war in Colombia wanes, some militias disband, others turn to crime (either to finance the militia or out of greed), and yet others refuse to disband and relocate into remote rural areas which the central government lacks the resources to police. A similar pattern happens in Mexico.
Feudal Europe also has a lot of these sorts of stories. Decentralization works, but eventually obviates the need for the central authority to exist in the first place. Libertarians might rejoice at the prospect of this, but the tendency when this happens is for conflict to increase as decentralization occurs.
The whistleblowers idea is an interesting one. These programs are effective because they outsource the cost of investigation to the whistleblower, but there is a key difference between these programs and privateering, which is that the whistleblowers are only initiating the process by identifying and documenting evidence of malfeasance; the actual enforcement action still passes through a government official that is accountable to the public.
The problem I see with offering legal sanction to what would otherwise be criminal behavior is that this hacking is not taking place in the context of a publicly-accountable police investigation. Would a Letter of Marque, once issued, protect the cyber privateer from liability in the event that he compromised the wrong system or accessed the data of the cybercriminal’s other victims?
- arealsociety 2y agoThe control on the privateers comes when they claim their spoils. They have to go before a prize court and prove they went after valid targets and were within the scope of their commission with whatever prizes they took. These courts can deny prizes, give damages to innocent victims, fine irresponsible privateers, and even revoke letters of marque.
- lurk2 2y agoThis doesn’t seem like much of a consolation to those who find themselves on the receiving end of abuse. The privateers have some incentive to make sure they do go after the right people to avoid losing the spoils, but you could conceivably run into scenarios where the process itself is abused to punish smaller entities (who then can’t go on to claim damages because they don’t have the resources to pursue a suit in the first place). I guess you could theoretically structure it in such a way that the letters are only issued to responsible parties who have to be vetted to ensure their owners are in good standing with the issuing authority; the privateers would then presumably act as contractors. Security isn’t my field so I apologize if the issues I’m raising seem ill-conceived, but it’s not completely clear to me what the improvement would be here over building a case and presenting it to a civil court for enforcement. I guess the problem is that the attacks originate in countries where foreign judgements are hard or impossible to file (China, North Korea, Russia), but in that case, what are these privateers actually doing to recover assets? Most of the “Scammer gets owned!” videos I have seen did not involve compromising systems for profit so much as identifying the scammer based on information that became accessible once they exposed their network to the uploader. What are the privateers actually seizing? Or is the prize court you envision not necessarily dedicated exclusively to the award of prizes, but instead to adjudicating whether an action taken by a privateer was legally justifiable?
- arealsociety 2y agoSo there will be several controls here on both the issuance and reward stage. Letters will be issued to vetted privateers, and will be for specific targets rather than a blank check to hack whoever they want. Victims won't be suing, but maybe they can bring potential targets for privateers or those issuing letters of marque, they will simply be involved in the prize courts when seized funds are distributed. It's easiest to envision what the privateers are seizing in crypto and ransomware because you're mostly dealing with funds, but privateers can also go after systems and bounties for affecting the capture of malicious hackers. Most of the current attackers are situated in non extradition countries so currently there's no real recourse. The scammer gets exposed type video are because the video can't do anything right now except what they are currently doing without breaking some serious laws. The general process is congress will identify an attacker, or have a submission process, and white hat groups will petition for a letter of marque, where they go through a vetting process. The white hats will then steal back any stolen funds, and go before a prize court that will determine if their actions were legal, if the target was valid, and how prizes should be distributed between victims and the privateers.