Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Why isn’t he in prison? I mean, going by the West’s own laws, or the spirit of them, anyway. Unless he is part of said West’s Armed Forces, in which case this would get really close to a casus belli.


> Why isn’t he in prison?

Not an enforcement priority for the same reason a lot of domestic abuse goes unprotected: the victim is uncoöperative.

> going by the West’s own laws, or the spirit of them, anyway

Pyongyang and prosecutors would have to show he attacked a “protected computer” under the CFAA [1]. Given the two routers he allegedly overwhelmed were internet connected, that shouldn’t technically be hard under Trotter and Kane. But it would be a novel expansion of interstate commerce to encompass a country with whom Americans cannot legally trade, i.e. do commerce.

Put another way, North Korea’s status as a sanctioned country might put this into a legal grey area—it might not be criminally punishable. To settle that question would take a lot of prosecutorial resources. It’s not clear those are well spent on a case where the witness won’t coöperate.

[1] https://www.coreyvarma.com/2015/01/what-is-the-computer-frau...


I can imagine he did piss of some agencies? I mean other states could have mapped NK's whole infra, made a plan to take down NK's internet when "needed" (i.e. in case of some event)... Then some dude triggers it just for fun...

Some things are too big to just mess around with, I would feel extremely vulnerable having pulled such a stunt.


> can imagine he did piss of some agencies

Sure. But OP asked why he isn’t being arrested. Plenty of people piss off the IC when they publish e.g. long-coveted (and independently discovered) zero days, or write an exposé on something an agency was hoarding for interagency political value.


or easily spy on ALL internet traffic, which they probably do anyway


Privateering is back, baby!


It's already back, Russian, Chinese and North Korean hacking groups receive state funding and cover.


> Privateering is back

Good point: a final hurdle inhibiting criminality is his lack of profits. No disgorgeable gains. That means you’re only left with damages, which again, requires the victim’s coöperation to assess.


there is a lot of 'looking the other way' when it comes to people hacking 'adversaries'. Just look at people going at russia's network now. western authorities arent exactly busy trying to stop that. i imagine similar priorities for NK, china and other places.


> Why isn’t he in prison?

He very much could, if politics changed. The US hates NK not because they are authoritarian but because they are not aligned. If they were to be aligned, and this guy didn't act on proper authorization, he could find himself in hot waters in the USA.

Plus he might have broken a bunch of "international" rules which could see him in trouble if he was to travel to some countries.

It is really reckless; but then there is a good chance he was acting behind some agency.


> there is a good chance he was acting behind some agency

Almost certainly not. The vector would have been saved. And he wouldn’t have maintained this public profile ex post facto.

Consider, for example, taking it down during today’s state visit? (After you’ve quadruple checked that the Russians have independent connectivity.)


"the West" has to keep some degree of not officially caring to avoid being backed into a policy corner and has no incentive to take law enforcement action when threat actors in those other countries operate with impunity.

We're already well into causus belli territory with NK, but nobody wants to go there: https://x.com/tarah/status/1798036415932187127


That link doesn't really explain what exactly it's talking about, it's a single reply with the original post invisible and all replies invisible. It speaks of a cyberattack without mentioning which one.


It works for me? That's normal behavior if you aren't signed into Twitter :(

Summary of thread: Society doesn't handle 2nd order consequences well. NK cryptolocker attack on healthcare-involved systems in British hospitals disrupted treatment to the extent that hundreds of people died who probably wouldn't have.

Expanding on that: Organized crime groups located in and sometimes tasked by RU SVR & GRU (not to mention NK state groups) have caused sufficient disruption to US healthcare systems to have indirectly caused more US Citizen deaths than the Sept 11 attacks. Right now cyber that does not directly cause destruction such as making buildings blow up or poisoning water supply is treated as just an annoying white collar crime.

I don't think anyone wants the US Government to be in a position where their options are to admit powerlessness or get proportional against nuclear armed states.

Somewhat related: https://blogs.icrc.org/law-and-policy/2023/10/04/8-rules-civ...


Because one of the 3 basic principles of sovereignty (as is understood by western political philosophy, known as Westphalian sovereignty) is that there is no other authority inside a State’s borders except its own.

This means no other country has jurisdiction in North Korea, besides, there’s also no incentive to help in case DPRK asks for help.

France doesn’t investigante crimes that happen in Spain, Portugal doesn’t investigate crimes that haven in Canada, the USA doesn’t investigate crimes that happen in Germany, etc…


> western political philosophy, known as Westphalian sovereignty) is that there is no other authority inside a State’s borders except its own

You’re citing centuries-old political philosophy, only remnants of which remain in our world [1].

The West that arose after WWII and through the Cold War is decidedly non-Westphalian. Concepts like human rights, non-proliferation and self determination are non-Westphalian. The Nuremberg trials were anti-Westphalian.

The closest modern analogues to (and proponents of) Westphalian philosophy are Russia, China and North Korea.

[1] https://en.m.wikipedia.org/wiki/Westphalian_system


These "proponents" seem less strict about applying this philosophy to states other than their own.


The Westphalian treaties gave France, Sweden and later Russia the explicit right to intercede to guarantee the Imperial constitution [1]. (Westphalia was concerned with the Holy Roman Empire.)

Westphalian sovereignty as a historical concern is a myth [2].

[1] https://en.m.wikipedia.org/wiki/Guarantor_of_the_imperial_co...

[2] https://www.cambridge.org/core/journals/international-organi...


>France doesn’t investigante crimes that happen in Spain, Portugal doesn’t investigate crimes that haven in Canada, the USA doesn’t investigate crimes that happen in Germany, etc…

https://en.wikipedia.org/wiki/Interpol

https://en.wikipedia.org/wiki/Europol


Remember this guy didn't fly to DPRK, he committed what could be considered crimes under CFAA while on US soil? (CFAA written broadly enough that taking a country offline could be considered to affect foreign commerce/communication of the US)


The FBI has offices around the world.


[flagged]


Well, if DPRK wanted to bomb countries so bad, they could be allied with US and NATO


Russia wanted to join nato, but nato wouldn't let them. Why would N korea even try then?


> Russia wanted to join nato, but nato wouldn't let them.

That's not true. You will not find a single law approved by Russian Duma that sets it as a foreign policy goal like in countries that did choose to join NATO.


Putin, at least, says he wanted to join NATO back in 2000 (according to the Stone interview). But he put it, "the U.S. delegation got very nervous."

Granted this was well before his total Machtergreifung, and he definitely was not equated with "Russia" at the time like he is now. But that's his telling of events, in any case.


Because the "rules based order" means a diferent set of rules for different situations.

If it's something "we like", then it's ok, if not, then prison.

Same for geopolitics... in one case, we care about teritorial integrity, that minorities should not seced, and in others we help with the breakup of countries... well.. or in some cases, we act is if nothing is happening at all, and noone wants to break away at all :)


Ајсе Cрбине реци им како ствари стоје, ја покушавам ал сам увек флегд :)


It would take someone that wanted to prosecute him. If his story is real he deserves a medal and possibly a job at the NSA/CIA instead of a court date.


Has NK asked to extradite him? Maybe a swap for the sony hackers?


Don't worry, the North Koreans, if sufficiently pissed, will take care of him.


No no no, ofc its morally justified to do such thing against impoverished nations! After all, if they are subjected to famine-inducing embargoes, they probably deserve it!


Self imposed poverty due to the authoritarianism. They’re the bad guys, we care less if bad things happen to them.




Consider applying for YC's Summer 2026 batch! Applications are open till May 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: