Why America's New Cyber Privateers Can't Go After North Korea

The White House’s August order allows government contractors to conduct authorized cyber operations against private criminal actors, but not state-sponsored groups such as North Korea’s Lazarus Group. The authority relies on the Computer Fraud and Abuse Act, requires approval from both the Justice Department and Treasury Department, and focuses on transnational criminal organizations, including ransomware groups, scam compounds, and cartels. The speakers said the limit is deliberate: private actors targeting a state could risk an act of war or raise international-law problems. Under the current approach, federal law-enforcement or military agencies must authorize and carry out action against state-sponsored hackers.

Chris Giancarlo and Chris Perkins have proposed modernizing letters of marque and reprisal, a constitutional power granted to Congress and historically used to authorize privateers against attacks on shipping. Their proposal would bring private-sector capabilities to bear against state-sponsored hackers, including Lazarus, but it is distinct from the August order’s narrower contractor model. The speakers stressed that the central restriction is who may act, not whether the United States can act: federal agencies, including the Department of Defense, should use offensive capabilities, while private firms can provide information or tools. Government officials, rather than contractors, should decide who may “throw the punch” and how far an operation goes.

Ari Redboard said North Korea has stolen an estimated $6–8 billion in cryptocurrency over roughly six to eight years, with proceeds supporting weapons proliferation and destabilizing activity. Another speaker characterized the country as a criminal state, not merely a government sponsoring Lazarus, and said investigations into North Korean Bitcoin laundering date to 2015–2016, when investigators also encountered counterfeit bills and cigarettes. Chinese banks and money-laundering networks, many linked to Chinese organized crime, have helped move funds at scale. Possible pressure includes sanctions, action against Chinese banks facilitating laundering, and curbing China’s purchases of North Korean coal. Because China is North Korea’s trade partner, pressure from Beijing could matter more than U.S. diplomatic pressure, though the speakers acknowledged there is no easy solution with a closed society.

The proposal need not be limited to retaliation after a specific cyber incident: private operations could be preemptive or target cyber-enabled crimes such as scam compounds stealing from Americans. But the speakers warned that private operations could escalate a conflict, making elected officials and experienced government decision-makers essential to setting limits. The National Security Presidential Memo describes private-sector innovation, scale, and speed as potential offensive advantages while retaining government control and requiring deep contractor vetting. The speakers supported starting incrementally and assessing the initial approach, while raising concerns about securing government-private-sector arrangements, particularly if AI companies were involved.

The urgency, Redboard argued, is increasing with automation. He cited about 7,500 ransomware attacks in 2025 and said he had seen end-to-end attacks in 2026 with no human in the loop. He warned that machine-speed ransomware could turn 7,500 attacks into 75,000 or even 7 million, and that automated attacks on hospitals, water filtration, or electric grids could pose a civilization-level threat. Laura Shin cited a TRM index showing criminal AI adoption up about 40 percent year over year and AI-involved scams up 13 times since 2022. The speakers also noted that U.S. infrastructure has known vulnerabilities, although many facilities have been hardened; non-networked grids and standalone nuclear plants may reduce the risk of one network weakness affecting multiple sites. AI could also help defenders find and repair vulnerabilities or design systems without them.

The speakers described a broader shift toward targeting criminal networks’ infrastructure and servers because the volume and speed of activity make individual cases impractical. They cited a past operation in which authorities secretly took over and monitored the Hansa dark-net market before shutting it down, and the Prince Group case, which involved sanctions, prosecution, and a forfeiture action described as $15 billion. A presidential memo set an October 11 deadline for agencies including the Justice Department to issue rules. Although the deadline had passed, one speaker had not confirmed publication and said sources reported that standards were being developed and might be distributed quietly. Separately, speakers noted that AI tools can help detect deepfakes and North Korean IT-worker schemes, after 11 government agency groups across countries warned in July about real-time deepfake videos in hiring interviews.