No Single Actor Controls Enough to Be Deterred: Why Law Enforcement Keeps Losing the Cybercrime Race- 323
August 7, 2026
At Black Hat USA 2026, Carole House, CEO of Penumbra Strategies and a senior fellow at the Atlantic Council, offered a diagnosis of cybercrime enforcement blunt enough to reframe the entire conversation: the problem isn't that law enforcement lacks tools, it's that the criminal ecosystem has organized itself specifically so that no single takedown can matter very much. Affiliate models have let non-state actors run ransomware-as-a-service operations, industrial-scale romance scams, and pig-butchering schemes with a level of coordination and reach that used to be the signature of well-resourced state actors — despite requiring far less technical sophistication to execute. "No single actor controls enough to be deterred by law enforcement actions," House told the room, and the rest of her session, titled "Deny. Disrupt. Dismantle. Breaking the Business Model of Cybercrime in the Gray Zone," worked through why that single sentence describes a structural failure rather than a temporary setback.
The criminal side of this equation has, in House's account, professionalized in ways that mirror legitimate business more than popular imagination of hacking suggests. Modern cybercrime operations run on franchise structures, divisions of labor, functioning human-resources departments, and customer-support channels operated openly through Telegram. Law enforcement's response, by contrast, has remained largely unchanged across that same period: investigate, attribute, indict, and hope the attribution holds up — a process House describes as "defending against a threat that's being continuously regenerated," since successful takedowns have historically produced only temporary disruption before threat actors stand up new infrastructure under new branding, with franchise models specifically designed to make any individual operator replaceable. Sanctions remain a favored tool because they can be applied quickly and serve attribution and public-shaming functions well, but House was clear that they don't fit every context equally, and treating them as a universal deterrent risks papering over gaps a more tailored strategy could close.
House's own government experience, including a stint as special adviser on cybersecurity and critical infrastructure policy at the White House National Security Council, gives her critique of the Trump administration's March 2026 executive order, "Combatting Cybercrime, Fraud, and Predatory Schemes Against American Citizens," particular weight. She credits the order with the right framing and an acknowledgment of state support for criminal ecosystems, but argues real gaps remain — and she points to an existing model worth extending rather than reinventing: the coordination frameworks law enforcement built specifically to fight ransomware, which put multiple organizations against a single high-value network simultaneously rather than each agency pursuing its own separate case. "That concept of putting multiple organizations against the most high-value network simultaneously — that is a really valuable tool," she said, arguing the new executive order's action plan should draw directly on that precedent for cybercrime broadly, not just ransomware specifically. Her frustration is personal as much as structural: several of the anti-fraud measures she helped put in place during her time in government were subsequently rescinded, a reversal she describes as difficult to watch play out, and she argues that being honest about which past efforts failed matters more for the field's future than celebrating the ones that worked, since "those failures teach us more than the wins."
The practical shift House recommends is a reprioritization around impact rather than actor identity: ordinary Americans don't particularly care whether a hospital or a gas station outage traces back to a nation-state or a non-state criminal group, they care about the disruption itself, and she argues enforcement priorities should organize around breach impact and the safe-haven jurisdictions protecting the responsible actors, rather than around traditional distinctions between state and criminal threats. That reorganization depends on information sharing that, by her account, still isn't happening reliably between agencies — when agencies withhold their own priority lists from each other, each one ends up optimizing for its own internal metrics rather than the ecosystem's most damaging networks. Jamie Levy, senior director of adversary tactics at Huntress, extends the same skepticism to the takedown model's remaining value even where enforcement action does succeed. Before AI-assisted development and so-called vibe coding became widely available, a successful takedown created a genuine vacuum that other ransomware operators would fight to fill — a real, if temporary, disruption. Now, she says, threat actors can rebuild infrastructure with AI tools essentially as fast as it gets torn down, leaving her uncertain whether takedowns meaningfully accomplish much at all anymore. Her proposed answer runs parallel to House's, from the private-sector side: rather than competing purely as businesses, security firms need genuine collaboration, and Huntress has already built informal Slack-based intelligence-sharing relationships with other companies specifically to flag when a partner's software shows up being abused inside an active campaign. "I feel like this is the only way forward," Levy said — a private-sector echo of House's public-sector argument that coordination, not additional enforcement capacity on its own, is the actual bottleneck standing between the current cybercrime ecosystem and anything resembling real deterrence.
