I am not sure what you are suggesting. Is your call for sanctioning private “hack-backs” of foreign organizations and individuals suspected of ransomware attacks, or is it more generally sanctioning attacks against organizations residing in state entities which are suspected of fostering ransomware groups? The analogy to letters-of-marque would suggest the latter—it did not matter if you were a peaceful merchant, if you were flying the flag of the enemy you were fair game.
Either one seems to be a terrible idea.
First, attribution of IT attacks is notoriously hard. Sure, in many cases you can see which IP addresses the attacker used, but chances are that they did not use their personal DSL to attack you directly, but attacked you through another victim whose only crime is that it too had insufficient network security.
Second, I do not really see how hacking ransomware groups backed by nation state actors would lead to their arrests. Redirecting plane flights to your own sovereign soil so you can arrest someone is a tactic which was used by several states, but I do not think that it is either feasible or wise to try this purely through software exploits. Nor do I think it is wise to normalize this behavior.
Third, ransomware groups have a much smaller attack surface than their targets. Your Texan municipality likely ran a bunch of services on a shoestring budget, probably based on a Microsoft stack, possibly end-of-life. By contrast, a successful ransomware group will have a security budget per employee that is orders of magnitude higher. They will likely not use Outlook+Office+AD in their network, and might not even use email for internal communication. They will also not run a bunch of half-baked online services to get an appointment at the DMV or whatever. Sure, the NSA might get into their network, but they would also be reluctant to burn through their precious hoarded 0-days to do so.
--
My counter-proposal would be to just criminalize paying the ransom. At the end of the day, ransomware is a coordination problem. If nobody ever paid, it would not be a thing. But once you have been hit with it, it is generally cheaper to pay than to accept an extended outage (at least, if the attacker calculated their ransom correctly). By making the expected costs for paying the ransom higher (e.g. through corporate death penalty or excessive taxes if caught), one can easily adjust incentives for the negative externalities.
More fundamentally, there is the victim’s narrative that IT security is impossible in the face of ransomware groups. “We bought advanced endpoint snake oil 2025 enterprise edition and sprinkled it all over our AD, and still we got hacked. This proves that when facing an adversary with a lot of criminal energy, even state of the art cybersecurity is insufficient.” Bollocks. If you had spent the kind of money you suddenly had when it came to paying the ransom beforehand, you likely would not have been hacked.
First, I kind of object to the “science-illiterate” part (I know it is a quote from the article). The soft sciences have done many wrongs, but with regard to the average physical ability of men and women, I don’t think that the depiction of women as just as capable is based on published studies.
Second, this is kind of culture war bait, and as such might be better asked at the motte.
Despite that, here are some possible answers.
With regard to gender differences, one might look at Women in chess. WP is quick to tell us that
But also:
Personally, I think that part of the reason is that women are generally less likely to go uber-nerd on a very small topic such as chess or warhammer and dedicate their life to that topic—which is what is likely required to be a top ten chess player. But I am also 50⁄50 on there being an inherent male advantage to chess. I think I can entertain that notion without having to adjust the worth of women in general. Emmy Noether shows that we dismiss the intelligence of women at our own peril.
The other thing which comes to mind is HBD, which is it’s own can of worms. See Scott Alexander on the Ashkenazi intelligence hypothesis, for example.