3 ms·

The control on the privateers comes when they claim their spoils. They have to go before a prize court and prove they went after valid targets and were within t

The control on the privateers comes when they claim their spoils. They have to go before a prize court and prove they went after valid targets and were within the scope of their commission with whatever prizes they took. These courts can deny prizes, give damages to innocent victims, fine irresponsible privateers, and even revoke letters of marque.

lurk2 2y ago
This doesn’t seem like much of a consolation to those who find themselves on the receiving end of abuse. The privateers have some incentive to make sure they do go after the right people to avoid losing the spoils, but you could conceivably run into scenarios where the process itself is abused to punish smaller entities (who then can’t go on to claim damages because they don’t have the resources to pursue a suit in the first place). I guess you could theoretically structure it in such a way that the letters are only issued to responsible parties who have to be vetted to ensure their owners are in good standing with the issuing authority; the privateers would then presumably act as contractors. Security isn’t my field so I apologize if the issues I’m raising seem ill-conceived, but it’s not completely clear to me what the improvement would be here over building a case and presenting it to a civil court for enforcement. I guess the problem is that the attacks originate in countries where foreign judgements are hard or impossible to file (China, North Korea, Russia), but in that case, what are these privateers actually doing to recover assets? Most of the “Scammer gets owned!” videos I have seen did not involve compromising systems for profit so much as identifying the scammer based on information that became accessible once they exposed their network to the uploader. What are the privateers actually seizing? Or is the prize court you envision not necessarily dedicated exclusively to the award of prizes, but instead to adjudicating whether an action taken by a privateer was legally justifiable?
- arealsociety 2y ago
  So there will be several controls here on both the issuance and reward stage. Letters will be issued to vetted privateers, and will be for specific targets rather than a blank check to hack whoever they want. Victims won't be suing, but maybe they can bring potential targets for privateers or those issuing letters of marque, they will simply be involved in the prize courts when seized funds are distributed. It's easiest to envision what the privateers are seizing in crypto and ransomware because you're mostly dealing with funds, but privateers can also go after systems and bounties for affecting the capture of malicious hackers. Most of the current attackers are situated in non extradition countries so currently there's no real recourse. The scammer gets exposed type video are because the video can't do anything right now except what they are currently doing without breaking some serious laws. The general process is congress will identify an attacker, or have a submission process, and white hat groups will petition for a letter of marque, where they go through a vetting process. The white hats will then steal back any stolen funds, and go before a prize court that will determine if their actions were legal, if the target was valid, and how prizes should be distributed between victims and the privateers.
  - lurk2 2y ago
    > The white hats will then steal back any stolen funds, and go before a prize court that will determine if their actions were legal, if the target was valid, and how prizes should be distributed between victims and the privateers. So the targets are determined by the state, and the costs of retaliating are assumed by the private sector; that sounds better than what I was originally envisioning. The government is effectively operating a bounty office, with the chief difference being that the bounty is paid out only after the successful recovery of the funds. It’s an interesting idea.

lurk2 2y ago

This doesn’t seem like much of a consolation to those who find themselves on the receiving end of abuse. The privateers have some incentive to make sure they do go after the right people to avoid losing the spoils, but you could conceivably run into scenarios where the process itself is abused to punish smaller entities (who then can’t go on to claim damages because they don’t have the resources to pursue a suit in the first place). I guess you could theoretically structure it in such a way that the letters are only issued to responsible parties who have to be vetted to ensure their owners are in good standing with the issuing authority; the privateers would then presumably act as contractors. Security isn’t my field so I apologize if the issues I’m raising seem ill-conceived, but it’s not completely clear to me what the improvement would be here over building a case and presenting it to a civil court for enforcement. I guess the problem is that the attacks originate in countries where foreign judgements are hard or impossible to file (China, North Korea, Russia), but in that case, what are these privateers actually doing to recover assets? Most of the “Scammer gets owned!” videos I have seen did not involve compromising systems for profit so much as identifying the scammer based on information that became accessible once they exposed their network to the uploader. What are the privateers actually seizing? Or is the prize court you envision not necessarily dedicated exclusively to the award of prizes, but instead to adjudicating whether an action taken by a privateer was legally justifiable?

arealsociety 2y ago
So there will be several controls here on both the issuance and reward stage. Letters will be issued to vetted privateers, and will be for specific targets rather than a blank check to hack whoever they want. Victims won't be suing, but maybe they can bring potential targets for privateers or those issuing letters of marque, they will simply be involved in the prize courts when seized funds are distributed. It's easiest to envision what the privateers are seizing in crypto and ransomware because you're mostly dealing with funds, but privateers can also go after systems and bounties for affecting the capture of malicious hackers. Most of the current attackers are situated in non extradition countries so currently there's no real recourse. The scammer gets exposed type video are because the video can't do anything right now except what they are currently doing without breaking some serious laws. The general process is congress will identify an attacker, or have a submission process, and white hat groups will petition for a letter of marque, where they go through a vetting process. The white hats will then steal back any stolen funds, and go before a prize court that will determine if their actions were legal, if the target was valid, and how prizes should be distributed between victims and the privateers.
- lurk2 2y ago
  > The white hats will then steal back any stolen funds, and go before a prize court that will determine if their actions were legal, if the target was valid, and how prizes should be distributed between victims and the privateers. So the targets are determined by the state, and the costs of retaliating are assumed by the private sector; that sounds better than what I was originally envisioning. The government is effectively operating a bounty office, with the chief difference being that the bounty is paid out only after the successful recovery of the funds. It’s an interesting idea.