Comment by supportengineer
1 day ago
I will never understand why there isn’t an international law enforcement agency with teeth, which can get rid of the bad actors.
1 day ago
I will never understand why there isn’t an international law enforcement agency with teeth, which can get rid of the bad actors.
Because every single nation would have to sign on to it allowing said agency to ignore sovereignty of each nation to come in and do their policing.
You'd also need to have every country not actively involved in these types of schemes yet we know some governments are directly benefiting from the scams/theft their citizens are perpetrating.
You'd also need to have every country think the things you want to police against are wrong. Again, we know that's just not true.
How did we (USA) so it with copyright law?
We didn't. The WTO copyright framework is a joke that only goes after sports rebroadcasting and people who watch Disney movies for free. Meanwhile every valuable piece of US science and industry has been replicated on the other side of the planet and used for great success.
Because there were large corporations using their political clout to make it a number one issue for your administration.
Your administration then made copyright law changes a central goal of many agreements - essentially a non-negotiable requirement for say a trade agreement to proceed.
International DDoS busts and arrests do happen all the time.
Law enforcement takes time. The perpetrators of these attacks aren't hanging out in the open with their full names shielded only by the hope that their country won't extradite for political favor.
By the time the perpetrators are identified and a case is built, getting them charged isn't bottlenecked on the lack of an international agency. Any international law enforcement agency would be beholden to each country's own political wills and ideals, meaning any "teeth" they had would be no more effective than what we currenly have for extraditing people or cooperating with foreign police organizations.
The international organisation for stopping wars, human trafficking, money laundering, drug distribution etc. however capable they might be, haven't managed to stamp out any of those things.
I'd say a putative UN NetWatch would suffer from the same issues of funding and corruption and politics, but still we might have something better than this wild west lawlessness.
> have something better than this wild west lawlessness.
Careful what you wish for. Before you know it you can't have an IP without your ID.
This is already the case in Germany and many other countries. Same for phone numbers. On the other hand, I get no spam calls, and I can't access the sites on https://cuiiliste.de/domains - censorship is amazing.
3 replies →
> The international organisation for stopping wars, human trafficking, money laundering, drug distribution etc. however capable they might be, haven't managed to stamp out any of those things.
They've never been expected to "stamp out" those things, any more than a city police department is expected to stamp out all crime and doctors are expected to stamp out all illness. Their mission is to reduce those things:
For warfare, they have been extremely successful relative to human history. War has actually become taboo and illegal, and very few happen. Look at history before the UN - it's a miracle. Think of the vision and confidence of people who, looking at 10,000 years of human history, immediately after two world wars, thought it was even possible, came up with effective strategy, did the hard work, and accomplished it.
I don't know the details of the other fields.
> I'd say a putative UN NetWatch would suffer from the same issues of funding and corruption and politics, but still we might have something better than this wild west lawlessness.
Politics and funding, and corruption, come with every human institution over a certain size, and especially with governments which can't exclude undesireable people: Democratic governments are the least corrupt, but if the people elect a corrupt representative or executive, then nobody can kick them out (unless they commit prosecutable crimes). And now imagine an association or confederation of governments, which is what the UN is.
So yes, the goal is to make something better. Otherwise, we might as well quit on everything.
> putative UN NetWatch
But who will suppress attempts to go beyond the blackwall then?
[dead]
Since this is a distributed attack, I'm not really sure how that enforcement would look like? Am I missing something, are all these bots/zombies easily selectable and blockable?
Investigative powers should be able to at least find and seize the command and control servers, and hopefully track down people operating the command and control servers.
Some sort of international clearing house for ISPs to help identify and sequester compromised customers might be nice, too; but that doesn't need law enforcement powers; and maybe it already exists?
Because countries benefit from conducting cyber warfare, the most publicised of are north Korea and Russia which have large state sponsored hacking groups.
It's national interest of China and Russia to see the West to fail. Why would they co-operate? They are willing to murder people, West and their own, so "law" enforcement means a bit different in international context.
It is absolutely not in China's interest to see the West fail. This is propaganda
China (or at least the CCP, I find the equivocation of the CCP with the country disagreeable) has had the desire or even need to get revenge for their "century of humiliation" for a long time.
They have a fundamentally different government and social model, basically a one person dictatorship that feels the need to micromanage and control their populace.
They absolutely love seeing democracy and businesses associated with it fail because it reinforces their perspective of the CCP model being superior and thus strengthens their perceived legitimacy (or even inevitability) of CCP control over China.
1 reply →
Typical brainwashed view.
It is China's national interests to see a stable America that can continue to maintain the post WWII world order that benefited China so much for so long. Without the US, who is going to maintain peace in the middle east, Africa and other places? without such peace, how could China export its goods and services?
"West" != America.
Your claim also implies that China and Russia are operating on the same level. That is laughable at best - Russia is a failed rogue state with the economic size comparable only to a Chinese province, it is left behind in ALL modern techs and its military hardware are aging fast. It is the complete opposite of the path took by China.
The whole sentiment with that is china uptakes the mantle. It already is in terms of infrastructure investments, selling goods and arms, import and export agreements. The same neoliberal playbook that made the US what it is. Only from a much more focused regime with little in the way of internal division or even external threats at this point.
Perhaps because, in many cases, the very governments responsible for enforcing it include the bad actors themselves.
the real reason why these are a problem in the first place is because of cgnat and transit providers not implementing flowspec.
but these bad actors are not possible to track down in the first place since internet is unfortunately decentralized and things as simple as transactions submitted to bitcoin or etherium blockchain can be used as c&c
> international law enforcement agency
You mean Team America, World Police?
Besides the fact that not much happens in the international public sector, law enforcement is more about deterrence than prevention. Criminals aren't deterred by law enforcement, so the bad actors never stop. Human nature's a bitch.
If they did focus on prevention instead, most of this could be... prevented. Create a treaty that mandates how critical infrastructure technology is created/sold. Consumer routers will stop being shit at security, and home devices are slowed-down in upstream spamming. That's a good chunk of the denial-of-service market gone, with no need to police the world.
...but the criminals are smart and intentionally avoid attacking the powerful, so nobody cares. Same reason organized crime still exists. It's poor people caught up in gang violence and crime, not rich people, so it persists.
How would you even enforce this if the offending country doesn't agree?
Limit their upstream connection to the rest of the internet via allied countries.
Literally the same as economic sanctions. The internet is a network of peers “trading” bits and bytes after all.
This won't do anything. The attacks are not from the offending countries they're from botnets of compromised devices.
North Korea doesn't care if you limit their internet they already allow people to go outside their own.
3 replies →
America already limits its upstream to China and Russia through a private companies such as Cloudflare and Spamhaus. It's often the case that for Chinese users seeking to escape censorship, once they've worked their way through the Chinese Great Firewall, they find themselves in front of the American one.
[dead]
do you really think for example America would allow say Chinese prosecutors to arrest Americans on American soil and take them abroad to sentence them in a court that America has no influence over and then throw them in a prison which America doesn’t control?
When the deed is illegal in both places, they can be tried under either jurisdiction and convicted instead of continuing to roam free and fuck up the open web for everyone else. Yes I do think we'd want that
Borders currently get in the way but we needn't have law enforcement on foreign soil to solve that. Exchanging information and reliably acting upon it could be all these agencies need to do in their respective countries. When this proves effective aside from crime states that have no interest in upholding even their own laws (since dual illegality would probably be a prerequisite for any of this), they may eventually find themselves increasingly cut off and distrusted until they, too, cooperate or self-isolate like NK
Bad news, implied criticism of CCP policy (by acknowledging you'd change it) is an imprisonable offense. You're under arrest for violating the laws of China. You are not granted a trial. A joint unit comprised of the Ministry of State Security and the FBI will be at your house to pick you up and fly you to a Chinese black site tomorrow morning.
1 reply →
>America would allow say Chinese
for at least 6 months
https://www.bbc.com/news/articles/c785n9pexjpo
https://www.justice.gov/archives/opa/pr/new-york-resident-pl...
Who would they take orders from?
from those who pay them. They are a service for hire. you can hire them if you want and have the dough.
If we were all running IPv6, we could just block this crap.
But here we are in 2025 still running IPv4 with CGNAT, so we can't.
Not sure how this would work, if you blocked those IPv6, the mostly innocent companies and people that are now blocked will be in short order getting a new IPv6 assigned by the ISP after a support call.
I was under the impression that these botnets still rely on vulnerable computers, which have a human that will be calling support asking for the issue to be resolved.
Then it needs an ISP to figure out the issue and ask the client to sort out their compromised computer, but unlikely the ISP will stop a paying customer from internet access especially if it's not clear why their original assigned IPv6 is blocked.
What difference would it make?
You can block the specific offending IPs without collateral damage.
CGNATs reuse IPs so any IP block rule fairly quickly becomes somebody else's IP that you shouldn't be blocking.
If, however, you use IPv6, you don't need CGNAT and, while addresses may change, a blocked address won't suddenly get recycled to an unsuspecting user. In addition, if the allocation is static, you can block the whole network range and the problematic devices can't change their allocation sufficiently to escape the IP block.
2 replies →
I'm sure you could come up with at least few ideas why it hasn't happened
Because it's not technicaly possible, I mean we're on HN, we all know how internet works.
You should talk to a network engineer before making claims like this. There are mechanisms to curtail DDOS attacks at origin.
For a few reasons (political, economical) there’s little will to enact them, these attacks are so few and far between and you can pay your way out of them in most cases, so the incentives aren’t there for ISPs (whom are a commodity judged primarily on price and bandwidth)
How exactly would you keep the origin from sending a command to a botnet?
7 replies →
I heard it's a series of tubes.
many countries sponsor these attackers
I mean, America can’t do anything about scam phone calls aimed at seniors who forge caller ID of local hospitals.
As alluded to by morkalork, they definitely could if they wanted to, as the (most? of the) rest of the world doesn't seem to have this problem. As long as spammers keep paying telecoms & no law(s) forbidding this exist, it will continue.
edit: grammar
> As long as spammers keep paying telecoms & no law(s) forbidding this exist, it will continue.
That's the trick. A lot of countries bill calls to cell phones at 10 cents a minute; in the US, calling is near zero cost. The US makes a great market for scammers to target because of low operating costs, penetration of globally usable payment cards, minimal language diversity.
Of course, these scams are forbidden by law, but that doesn't change the economics. Very few scam shops get busted; especially when most of them run from outside the US. STIR/SHAKEN helps a bit, but not much... without a effective mechanism to report unwanted calls that leads to those callers being ejected from the network as well as ejecting providers that are unresponsive to reports, there's not really hope of progress.
Can't or won't?
I’ve decided there isn’t a difference.
Who is going to elect and oversee them? I don't want to be governed by China or Russia.
What countries do you think these bad actors reside? Russia, China, Iran, and NK will wipe their ass with any law enforcement request.
Those exist but they might have a different idea of what makes an actor bad than you and I. Just look at what happened to Julian Assange.
Legal systems are so convoluted and so colossally heterogenous - also very protective of their ways - around the globe that miniscule collaborations require grandiose efforts to initiate and maintain. No chance these fast paced adversaries will be caught by the interplay of several dozens of reluctant dinosaur legal systems.
Tangential: once I was targeted by a pretty primitive scam. More than 10 years ago (after someone I love was naive and inexperienced, having a medium amount stolen in a sensitive and stressful time of this person's life). I recognised fast and having time and will I sarted to play along, pretending I bite the bait. Collecting info while acting. In parallel trying to connect local and international authorities to report an ongoing scam effort. I believe I tried 4 organizations in 3 different countries apparently involved, I believe one was dedicated to online scams, also trying to warn Western Union, they are about to be used for scam. I even went personally to a police station locally to get some advice on how to assist catching the criminals. Since all I encountered insisted to report my damages, so they could start an investigation on an actual loss happened, I furiously gave up and decided whenever I will be having financial trouble I will invest my efforts in scamming others. No-one cares catching those in act! So the thugs can be incredibly bold and dumb, like the one I encountered, it is no effort doing better.
America gonna allow someone else to regulate them?