The New Privateers Won't Know Whose Ship They're Boarding

Confidence: HIGH · United States, Germany, North Korea · Technology, Financial Services

North Korea's hacking units funded roughly $2.84 billion of the regime's nuclear and missile programs through cryptocurrency theft between January 2024 and September 2025, according to the Multilateral Sanctions Monitoring Team, the eleven-nation coalition that took over UN sanctions monitoring after the original UN Panel of Experts was disbanded. No toolkit built for ordinary criminals has stopped it, and the broader losses Congress itself cites, billions lost to Americans annually through crypto scams, ransomware, and fraud, are real. Indictments against people who never see a US courtroom genuinely are losing that fight. Congress and the White House are now moving on separate tracks to close the gap by commissioning the private sector to hit back, and they're not alone.

H.R. 9697 and its identical Senate companion, S. 5000, the Cyber Letters of Marque and Reprisal Act, invoke a constitutional power dating to Article I to authorize the President to deputize private companies against any "designated cyberthreat," a foreign group he places on a public registry. No indictment or conviction is required to get there. Deputized operators can seize digital assets, disrupt infrastructure, and use malware and other offensive tools to disrupt, degrade, deny, or destroy a target's systems. They post a security bond, log their activity for five years, and keep the majority of what they recover: up to 15 percent can be clawed back to fund future operations, and informants who never hold a letter can still claim 5 percent of a recovery for a tip. Section 8 grants blanket civil immunity for anything "expressly authorized" by the letter.

The White House got there first, and by a different legal route. An August 12 presidential memorandum already lets vetted private companies run offensive operations against transnational cyber-enabled crime groups, no new legislation required. The Justice and Homeland Security Departments co-run a National Coordination Center that vets participating companies on technical proficiency, facility security, and personnel reliability, requires a minimum $1 million bond, and must approve every operation in writing before it runs. Operations are barred only if they would likely cause loss of life, serious injury, or a use of force under international law. The program's own operating procedures are due October 11, sixty days after the memo was signed. They do not exist yet.

The same day, Germany's cabinet approved a parallel authority through a completely different mechanism. A 732-page bill gives the BND, Germany's foreign intelligence service, power to sabotage adversaries' supply chains directly. The Chancellery's own chief of staff described the power in blunt terms: agents would be authorized to "substitute faulty components into deliveries." Unlike the US programs, this isn't outsourced to private companies, it's state intelligence agents doing the tampering themselves.

A privateer in 1812 could look at a ship's colors and know who he was allowed to board. State-linked hacking infrastructure carries no equivalent flag: operators tied to North Korea routinely run their infrastructure on the same commercial clouds every other company uses, because blending into legitimate traffic is the point. The bill limits authorized targets to infrastructure located outside the United States. It separately bars operators from knowingly targeting a US citizen or entity. Both are guardrails on paper, but a US company's foreign subsidiary, foreign cloud region, or overseas vendor sits squarely inside the zone either US track actually authorizes, and neither track defines what "knowingly" requires an operator to check before striking.

The Takeaway: The White House's program has an October 11 deadline for its operating procedures and Congress writes its version whenever H.R. 9697 clears committee, so what exists today is a preview, not the final version. Map your foreign infrastructure exposure now, and keep tracking what the final version turns out to be.

Sources: H.R. 9697, Cyber Letters of Marque and Reprisal Act — full text · S. 5000, identical Senate companion · White House: Expanding Capabilities to Combat Transnational Cyber-Enabled Crime, Aug 12, 2026 · NK News: North Korea's cyber army funds nuclear arms with $2.8B in stolen crypto — MSMT · The Record: Germany spy agency powers

The 500 Attorneys Reading Your Country-of-Origin Certificate

Confidence: HIGH · United States · Manufacturing, Logistics, Retail

Tariffs on imported goods are higher this year than they've been in decades, which makes it more valuable than ever for a company to fudge where a product actually came from, since the tariff rate usually depends on that answer. DOJ's response to that problem isn't new or hypothetical: a joint DOJ–Homeland Security task force built for exactly this, the Trade Fraud Task Force, has already recovered more than $1 billion in penalties, forfeitures, and charged losses since it launched in August 2025.

What changed on August 13 is scale. Colin McDonald, the Assistant Attorney General running DOJ's National Fraud Enforcement Division, told staff the division, of which trade fraud is one of five permanent priorities alongside health care, public trust, tax, and corporate misconduct, will grow to roughly 500 attorneys and staff by August 24, with continued growth planned for two more years. The trade unit, formally stood up in July as the Global Trade and Commerce Enforcement Section, targets a specific list: routing goods through a third country to disguise where they really came from, mislabeling origin outright, undervaluing shipments to cut the tariff owed, sanctions evasion, and forced-labor supply chains.

The detail worth taking seriously: legal analysis of DOJ's own guidance says liability doesn't stop at the company that imported the goods. It reaches customs brokers, downstream distributors, and the businesses that bought the product without asking where it came from, and not knowing isn't a defense if a reasonable check would have caught the problem.

The memo separately cites a Government Accountability Office finding, GAO is Congress's independent auditor, that fraud costs the federal government $233 billion to $521 billion a year, the kind of number that explains why this division keeps growing instead of staying a side project.

The Takeaway: This liability reaches past the importer of record to the broker who filed the paperwork and the distributor who resold the goods without asking questions. Confirm your suppliers can document where their products actually came from, that the declared value matches what was actually paid, and that nobody in your supply chain is simply repeating what they were told rather than verifying it.

Sources: DOJ memorandum: The Fraud Division's Enforcement Priorities, Aug 13, 2026 · DLA Piper: DOJ launches Global Trade and Commerce Enforcement Section, Aug 2026 · GAO: Federal Government Loses an Estimated $233B–$521B Annually to Fraud

Boeing's Board Won Because It Took Good Notes

Confidence: HIGH · United States · Technology, Manufacturing

A Delaware court just told corporate boards what actually protects them when something goes wrong, and it isn't the outcome. On August 13, Vice Chancellor Morgan Zurn, a judge on the Delaware Court of Chancery, the state's specialized business court, dismissed, with prejudice, a shareholder lawsuit trying to hold Boeing's directors personally liable for the safety failures behind the January 2024 Alaska Airlines door-plug blowout. Plaintiffs argued the board ignored warning signs and pushed unsafe production targets. The court disagreed: Boeing's own records showed the board had received detailed safety reports and had acted on them, adjusting production in response. "If everything is a red flag, then nothing is," the court wrote. Directors don't have to prevent every failure. They have to show they built a system to hear about problems, and used it.

That standard, the Caremark doctrine, the legal test Delaware uses to decide when a board can be held personally liable for failing to oversee a risk, is the same one facing a newer kind of claim. Three pending shareholder suits, two against Adobe and one against Microsoft, argue those boards failed to oversee AI systems trained on copyrighted material without permission. The Adobe suits allege its board knowingly trained its SlimLM models on a pirated-book dataset under what plaintiffs call an "ask forgiveness, not approval" approach, meaning the board knew and moved ahead rather than being caught off guard. The Microsoft suit goes further, claiming the board didn't just miss OpenAI training on unlicensed material through Microsoft's own Azure infrastructure, it approved proxy statements written specifically to defeat shareholder proposals asking about that exact copyright risk.

That's the distinction Boeing's win actually turns on. Zurn protected Boeing's board because the record showed good-faith oversight, reports received, production adjusted in response, even though the outcome was still bad. She was explicit that the protection disappears for intentional dereliction or conscious disregard of a known risk. Adobe and Microsoft aren't accused of an oversight gap nobody noticed. They're accused of knowing and choosing not to act, which sits on the unprotected side of the line Zurn just drew, not the side that saved Boeing.

The Takeaway: The instinct to keep AI-risk discussions off the record, on the theory that no paper trail means nothing to use against you, is counterintuitive. Boeing's board survived because it could point to specific reports and specific responses, not because it avoided creating a record. Skip the minutes and you're not protecting yourself. You're removing the only evidence that would prove you did what this ruling says actually matters.

Sources: Sullivan & Cromwell: Delaware Court of Chancery Reinforces Limits on Oversight Liability · Law360: Boeing Beats Suit Over Board's 737 Max Safety Oversight · Bloomberg Law: Microsoft Shareholder Sues Top Brass for AI Copyright Claims · Bloomberg Law: Adobe Investor Sues Board Over AI Training Copyright Accusations

Kazakhstan Turned the Safety Net Into a Weapon

Confidence: HIGH · Kazakhstan, Burkina Faso, Netherlands · Energy, Financial Services

Any company that signs a long-term contract with a foreign government typically insists on one specific protection: an arbitration clause, a promise that if a dispute ever happens, it gets decided by a neutral international panel instead of that government's own courts. The assumption behind that clause is that it protects the company from the government. A new dispute out of Kazakhstan shows the same clause working the other way.

In the 2000s, Kazakhstan brought in six of the world's largest oil companies, called "oil majors" because of their size and global reach, to build out one of the world's biggest oil fields, Kashagan, and share in what it produced. The six: Shell, ExxonMobil, Eni, TotalEnergies, China's state oil company, and Japan's Inpex. Under the resulting deal, Kazakhstan gets a modest royalty and the companies keep the rest, which Kazakhstan says works out to roughly 98 percent of the oil revenue going to the consortium.

Kazakhstan now alleges two separate problems, and is using its own arbitration clause to sue over both. First, that a dozen of the construction contracts from the field's buildout, worth $10.7 billion, were awarded through bribery or self-dealing instead of a fair bidding process. Second, that the revenue split itself was never fair to begin with. Combined, Kazakhstan is seeking $160 billion, in a case filed at the Permanent Court of Arbitration in The Hague and believed to be the largest arbitration claim ever brought. The case has run confidentially since it was filed in 2023; a leaked interim ruling obtained by the International Consortium of Investigative Journalists is the first public look at it. Hearings are expected to continue until at least 2028.

Here's why this matters beyond six oil companies: arbitration clauses get sold to boards as protection against a government trying to cheat a company, not the other way around. Two other cases from the past three weeks test the same architecture from different angles. In Burkina Faso, a national court nullified a 2014 gold-streaming contract with two Canadian companies, Franco-Nevada and Sandstorm Gold, ordered them to pay roughly $9.3 million, and rejected their argument that Burkina Faso's courts had no authority over the dispute. Franco-Nevada is now separately litigating the same contract in Ontario, meaning two countries' courts could rule differently on the same facts. In the Netherlands, a sanctioned Russian businessman has filed investment-treaty arbitration against the Dutch government itself, the third European country he's targeted, turning the same tools built to protect companies from governments into a weapon against one. Kazakhstan is the most direct version yet: not a court refusing to honor a contract's chosen forum, and not an individual suing a government, but the government itself picking up the arbitration clause and using it against the companies it was written to protect.

The Takeaway: If your company holds a similar contract with a foreign government, a concession, a licensing deal, an offtake agreement, you're relying on the exact same clause for the exact same protection Kazakhstan just flipped. The paperwork proving how you won the deal and how you've run it since isn't neutral background anymore. It's what the other side would use to build the same kind of claim against you.

Sources: ICIJ: Kazakhstan alleges Big Oil corruption tainted $10.7 billion in contracts, delayed key oil project · ICIJ: Behind closed doors, Kazakhstan challenges decades-old deal with $160 billion claim against Big Oil · OilPrice.com: Kazakhstan Accuses Big Oil of $10.7 Billion Corruption in Kashagan Oil Project · Financial Afrik: Burkina Faso justice cancels gold streaming contract of Franco-Nevada and Sandstorm · NL Times: Russian billionaire seeks damages from Netherlands over sanctions-driven bank collapse

Someone Just Made Your Server Delivery Worth Stealing

Confidence: HIGH · United States, China · Technology, Logistics

A Nvidia DGX B300, a high-end AI server, sells for more than $1.1 million on China's black market, more than double its roughly $550,000 US retail price. Export controls have created a real market for stolen equipment, one worth enough that people are already going to serious lengths to acquire the hardware.

In March, federal prosecutors indicted three people, including a Super Micro Computer co-founder and board member, Yih-Shyan Liaw, over an alleged scheme to smuggle $2.5 billion worth of Nvidia-powered servers to China. Court documents describe a Southeast Asian shell company that bought the servers on paper, rerouted them to Chinese buyers, stripped manufacturer labels and serial numbers with hair dryers, and left dummy equipment behind to pass inventory audits, all coordinated over encrypted messaging apps to stay hidden from Super Micro's own compliance team. Super Micro's stock fell 33 percent the day the indictment became public.

The same economics are now showing up on ordinary freight routes. On June 18, the Cook County Sheriff's Office recovered two stolen trailers in a truck yard near Chicago: one carrying roughly $300,000 in copper wire, stolen out of Alabama, the other carrying about $1 million in data center equipment, stolen out of Florida. The trailer was displaying Indiana license plates that had themselves been reported stolen in Wisconsin. Verisk CargoNet, which tracks cargo theft industry-wide, has flagged enterprise computing and networking equipment, the RAM, storage drives, and server components that make up a data center, as one of the categories organized theft rings are targeting most, noting that shipments worth millions of dollars routinely move as ordinary freight with no special security.

The Takeaway: Data center hardware is now a real target for organized theft. If a shipment is taken, the problem usually isn't the insurance check, it's that a replacement may not exist on any reasonable timeline, because of short supply combined with how many companies are the single source supplier for this equipment.

Sources: DOJ: Three Charged with Conspiring to Unlawfully Divert Cutting Edge U.S. Artificial Intelligence Technology to China · CNBC: Super Micro shares tank 33% after employees charged with smuggling Nvidia chips to China · Dataconomy: Nvidia's B300 Systems Fetch Over $1 Million On China's Underground Market · FreightWaves: $1.3M in stolen copper wire and data center equipment recovered near Chicago · Verisk: Cargo Theft Losses More Than Double to $304 Million in Q2

Two Terrorist Groups Just Made Piracy Profitable Again

Confidence: MODERATE · Somalia, Yemen · Logistics, Energy, Insurance

Somali piracy nearly disappeared after 2011, suppressed by years of international naval patrols. It came back this year in the worst wave in a decade: three tankers hijacked between April and July, with ransom demands of $3 million and $10 million on two of them.

What brought it back isn't just opportunity. Ships rerouting around the Horn of Africa to avoid the closed Strait of Hormuz, on top of the rerouting that started with Houthi attacks in the Red Sea, have put far more traffic within reach of pirate networks that had gone quiet for lack of targets. Reporting also describes something new: direct coordination between Yemen's Houthi movement and Somali pirates, with the Houthis supplying weapons, training, and GPS tracking equipment. Al-Shabaab, the al-Qaeda-linked group controlling large parts of southern Somalia, provides onshore logistics and takes up to 30 percent of every ransom paid. Both organizations are US-designated terrorist groups. One conflict is now directly subsidizing a second, previously unrelated criminal enterprise.

The pressure on al-Shabaab, the group now profiting onshore from this, is also about to ease. The US announced in July it will stop funding the UN logistics office that keeps the African Union's 12,000-strong Somalia peacekeeping force running, fuel, transport, medical care, salaries, by December 31. That force's mission is fighting al-Shabaab on land, not patrolling the coast, but a weaker counterinsurgency effort means a stronger, more entrenched al-Shabaab, the same group now taking a cut of ransoms it had no stake in a decade ago. That mission was already funded at roughly a quarter of its budget before the US exit.

Piracy off Somalia had looked like a solved problem for over a decade. It's coming back at the exact moment the force keeping its onshore enabler in check is being defunded, and this time with two terrorist organizations profiting from it directly instead of one operating alone.

The Takeaway: Piracy off Somalia was never actually solved. It was suppressed by years of naval patrols and a land campaign that kept its onshore enablers weak, and both cost money. On December 31, the funding for one of those efforts stops. Iran gets the headlines right now, but this is a second, quieter tax on shipping, one that rarely gets accounted for until it's already baked into the price.

Sources: OilPrice: Somali Piracy Surges Amid Hormuz Blockade · ACLED: What does the U.S. funding exit from UNSOS mean for Somalia's stability?

The Permit Was Never Actually Valid, and Nobody Found Out for a Decade

Confidence: HIGH · South Africa · Energy, Manufacturing

South Africa's highest court permanently ended Shell's right to explore for oil and gas off the country's Wild Coast on August 14, closing a legal fight that started with the right itself: granted in 2014. The Constitutional Court found the original public consultation with local communities was inadequate, the same finding a lower court had already made in 2024. What changed this time is the remedy. The 2024 ruling gave Shell a path back: fix the consultation defect, reapply, try again. The Constitutional Court closed that path entirely. There is no cure, no renewal, no second attempt. The right is over, more than a decade after it was granted and years into active legal and commercial commitment to the project.

The plaintiffs weren't a competitor or a regulator. They were Wild Coast fishing communities and environmental organizations who argued from the start that they were never properly consulted before the government issued the right. That argument took five years to work through the courts and succeeded completely: the flaw wasn't in how Shell operated the permit, it was in how the permit was granted in the first place, and that flaw turned out to be fatal no matter how much time or capital was invested after the fact.

This doesn't end Shell's presence in South Africa, it still holds a separate authorization to drill a different offshore block on the country's west coast. But the mechanism has nothing to do with Shell or oil and gas specifically. Any project resting on a government-issued permit, a mining concession, a construction approval, a telecom license, an environmental authorization, carries the same exposure: if the underlying consultation or approval process had a real defect when it was issued, that defect doesn't age out. It can surface a decade later and end the project regardless of how much has already been spent.

There's a bigger legal shift inside this ruling too, with one caveat worth stating plainly: it traces to a single outlet's characterization, not something independently confirmed here. That outlet describes the ruling as the first binding court judgment in Africa to cite the International Court of Justice's climate change advisory opinion as part of its reasoning, folding international climate law into an otherwise domestic property-rights case. On firmer ground, the court was explicit on a point that reaches past Shell: money already spent cannot override a constitutional or procedural violation, no matter the size of the sunk cost. Multiple outlets covering the ruling expect it to shape not just future exploration applications along South Africa's entire coastline, but other oil, gas, and mining disputes already working through the country's courts.

The Takeaway: If your company holds a concession, license, or permit a foreign government granted years ago, put it on the risk register, it can still be taken away over a defect nobody currently involved in the project ever created. Weigh that same risk the next time you're evaluating a new project in a foreign jurisdiction, not just the ones you already hold. A government's sign-off today doesn't retire the risk that the process behind it was flawed.

Sources: OilPrice: South Africa's Top Court Blocks Shell's Wild Coast Exploration · Daily Maverick: ConCourt ends Shell's Wild Coast oil and gas lifeline in victory for coastal communities · TimesLive: Constitutional Court blocks Shell's Wild Coast exploration plans

Got this forwarded to you? Subscribe at stateofthethreat.com/subscribe — one email per week, no tracking, no spam.

Know someone who needs this? Forward this email. The threats they don't know about are the ones that hurt.