# Law Enforcement Is Losing the Cyber War — and Both Problems Are Self-Inflicted
The FBI's 2024 Internet Crime Report put cybercrime losses in the United States at more than $16 billion. That number has grown every single year for the past decade. The agencies tasked with stopping it have not kept pace — not in budget, not in headcount, and frankly, not in seriousness. The gap between what cybercrime costs the economy and what we spend fighting it has become one of the most consequential policy failures in modern law enforcement, and almost nobody outside the security community talks about it directly.
This is that conversation.
## The Numbers Are Embarrassing
Start with money, because it clarifies everything. The FBI's Cyber Division operates on a fraction of what a mid-sized ransomware gang can pull in during a single campaign. LockBit, before its partial disruption via Operation Cronos in early 2024, reportedly netted over $120 million in ransom payments in a single year. Scattered Spider, a loosely organized group with members averaging in their early twenties, walked away with more than $200 million from MGM Resorts and Caesars Entertainment over a few weeks in 2023.
Compare that to what state and local police departments have to work with. Most don't have a cyber unit at all. The ones that do often consist of one or two people who also handle other digital forensics work — recovering deleted text messages from domestic abuse cases, working child exploitation material — alongside the expectation that they'll investigate ransomware against local hospitals and business email compromise against city governments. The resource math doesn't work and everyone in the building knows it.
Federal agencies do better, but "better" is relative. IC3 received over 880,000 complaints last year. The number of those that resulted in prosecution is a rounding error. The Department of Justice celebrates major arrests — and some of them, like the takedown of BreachForums administrator Pompompurin or the Hive ransomware infrastructure seizure — are genuine operational wins. But they're wins against a tide that doesn't stop between press conferences.
## The Brain Drain Nobody Wants to Admit
Here's the money problem inside the money problem: the federal government trains some of the best cyber investigators in the world, and then the private sector poaches them.
An FBI cyber agent with five years of experience and serious technical chops can triple their salary walking across the street to CrowdStrike, Mandiant, or Palo Alto Networks. They get better tools, fewer bureaucratic constraints, and they don't have to write warrants for information sitting in a cloud jurisdiction the courts haven't fully sorted out yet. The private sector talent pipeline runs in one direction — out of government.
Microsoft's Digital Crimes Unit, Google's Threat Analysis Group, and Recorded Future's Insikt Group now routinely publish attribution-level analysis that rivals or exceeds what law enforcement releases publicly. These aren't just research outfits; they're doing active disruption work, seizing domains and infrastructure, coordinating takedowns. The state increasingly depends on private companies to do the investigation it can't resource adequately itself.
That's a structural problem with serious long-term consequences for accountability, for due process, and for who sets the agenda in cyber enforcement.
## The Culture Is the Harder Fix
Money is fixable, at least in theory. Mindset is harder, because it's embedded in how agencies are organized, how leadership got promoted, and how success gets measured.
Cybercrime suffers from what you might call the "it's just data" dismissal — the instinct, still common among senior law enforcement officials who built their careers before smartphones, to treat digital crime as somehow less serious than physical crime. Property crime has a victim. Assault has a victim. Ransomware hitting a rural hospital and forcing ambulance diversions that contribute to patient deaths — somehow that still gets classified in ways that don't trigger the same urgency.
Prosecutors compound the problem. Cyber cases are complex, technical, and hard to explain to juries. A motivated U.S. attorney can build a career on a drug trafficking bust or a public corruption case. A botnet prosecution requiring eight months of technical testimony about server infrastructure in four countries does not make the same career. So the cases don't get prioritized, and the deterrence never materializes.
The jurisdictional mindset is perhaps the most anachronistic obstacle. Cybercrime is explicitly borderless — the threat actor is in Eastern Europe, the infrastructure is in Malaysia, the victim is in Ohio. Local police default to "not our jurisdiction," state agencies look to federal, and federal agencies are already overwhelmed with cases that have clearer prosecution paths. Reporting gaps are significant. Most cybercrime victims, particularly businesses, never report to law enforcement at all because they've concluded nothing useful will come of it.
## Where the Private Sector Stepped Into the Void
The insurance industry has quietly become one of the most active cyber-investigation networks in the world — not because carriers want to catch criminals, but because they want to recover funds and understand their exposure. Major insurers now maintain internal cyber forensics teams and fund incident response firms that effectively do first-response work law enforcement can't reach in time.
This isn't ideal. Insurance-funded investigations optimize for coverage decisions, not justice. They produce proprietary intelligence that doesn't get shared systematically with law enforcement or the broader defender community. It's a functional arrangement that perpetuates the problem by reducing the pressure on government to build its own capacity.
The international picture is more nuanced. When political will exists — when the crime hits the right target or the right pressure is applied — cooperation between the FBI, Europol, Interpol, and national agencies can be devastatingly effective. Operation Duck Hunt dismantled the Qakbot botnet in 2023. Operation Cronos disrupted LockBit's infrastructure. Romania and Ukraine have made significant arrests when they chose to act. The capability is there when the will is there. The question is why the will remains so intermittent.
---
## HackWire Analysis
The framing of "money and mindset" as co-equal problems understates how tightly they're linked. Mindset drives budget allocation — agencies with leadership that genuinely understands the threat make the case to legislatures and win resources. Money drives mindset — when you've been told for twenty years that your department's cyber unit gets whatever's left over after everything else, you internalize that cybercrime isn't a priority.
What's missing from most coverage of this issue is the local government angle. When a small city gets hit with ransomware — and hundreds have — they call the FBI, who logs the complaint and explains they're overwhelmed. They call the state police, who don't have the capability. They call their IT vendor, who wasn't trained for incident response. They call their cyber insurance carrier, who starts the clock on coverage decisions. What they don't get is a detective who shows up, takes the case seriously, and builds toward a prosecution.
The private sector filling this gap isn't a solution — it's a subsidy that lets governments avoid the hard political work of building sustainable public cyber law enforcement capacity. The analogy to financial crime is instructive: it took decades to build the AML frameworks and financial intelligence infrastructure that now catches money laundering at scale. Cyber is at an earlier inflection point. The question is whether policymakers wait for a crisis that can't be ignored, or get ahead of it.
There is also a deterrence asymmetry worth naming: cybercriminals in safe-harbor jurisdictions have spent years calculating that the probability of prosecution approaches zero. That calculation is mostly correct. Until it changes, the economics favor the attacker.
— HackWire Editorial
---
## Related Coverage