With the resources of the federal government, it shouldn't be hard to find and take down the criminals. Think of how easily the criminals exploit their victims - it is just as hard for the criminals to play defense as it is for everyone else.
True cost of each investigation is probably in the millions so investigating hacking of random small company is probably not high on the list of priorities. Evidence that can hold up in the court are hard to come by.
With all the talk about Russian hackers hacking Dem Party, elections, etc, there are zero people in the jail and zero evidence presented that it was even Russians. So it's hard.
You can remove a lot of threats by just blocking every country you have no desire to reach people in. And if major hosting and cloud providers were restricted similarly such that foreign actors can't just rent US servers to stage attacks from...
I'm aware this is an unpopular opinion amongst tech crowds, but it's impossible to maintain order in an environment where some people have to obey the law and some people don't.
It doesn’t solve the problem, but it’s low hanging fruit, and a few checkboxes (or lines of Terraform) if you’re at a cloud provider and using the usual primitives.
ACM also blocked a lot of Indonesian IP addresses (because "infiltrated by sci-hub" according to their support, but since carried-grade NAT is ubiquitous here you end up blocking vast swaths of the country).
All in all, it's really annoying.
Yeah, you're going to stop various bad actors with this – no denying that – but you're also going to block your own nationals who happen to be abroad. Especially for a lot of critical services (banks, gov't, etc.) it's pretty much a non-starter.
That's why this approach is only really complete if supported at a national level. Cloud providers in the US shouldn't be allowing foreign actors to rent them, for instance.
It's possible if US law enforcement bothers working with their counterparts in "unfriendly" countries (I doubt they even reach out to them).
Case in point: 10 years ago a bunch of Russian scammers scammed Americans out of thousands of dollars pretending to be a valid mail order bride business. As far as I remember, because US police did nothing ("it's Russia! we can't do anything"), one of the Americans had to contact Russian police directly. A criminal case was opened and Russian police eventually busted a whole network of scammers. I know because they were based in my city, there was TV coverage. Those scammers targeted only foreigners so our police wasn't even aware they existed, because no one filed anything.
It may be problematic, but Russia are part of Interpol, so surely a record of the crime should have at least been made.
Sounds like apathetic policing.
The resources are whatever Congress and the President makes them. The budget is typically over $2 trillion. Dedicating overwhelming resources - billions of dollars, far beyond any hacker group - to the purpose would be a rounding error. The potential access to expertise and equipment is far beyond any hacker group. The legal power is enormous - the government can access, through cooperation and compulsion, so many systems that the hackers would have to try to access at great expense. What major company is going to resist cooperating against these people? They may enthusiastically participate. Just think of the potential of backbone operators, cloud providers, etc. etc. cooperating.
> zero evidence presented that it was even Russians
I believe that's false.
> (jurisdiction issues)
It's a problem, but not impossible. The US has enormous power in the world if they want to use it.
couple that with the literal marketplaces of hacked Windows computers that you can remote desktop into by country, postal code and bandwidth metrics, the best case is that you end up framing someone
https://sec.okta.com/articles/2020/08/crimeops-operational-a...
No money so no incentive.
Notice, however, when an "oil pipeline" had their billing software hacked everybody went apeshit.
If anything, their shutdown of the pipeline should be illegal/prosecuted, on the grounds of being limited in what you can do business wise if you're operating critical infrastructure.
No one gives them a pass. Law enforcement, however, requires a method of enforcement. You have anonymous emails request Bitcoin to anonymous wallet, what do you "enforce" your laws on?
don't know the first thing about how to even collect evidence to aid in prosecution.
don't know what crime has happened.
no one died.
probably from another country and "that ain't my jurisdiction"
lazy
etc.