iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Cyber-enabled fraud at organized-crime scale cannot be answered by telling each victim to be more careful. The response has to reach the infrastructure, money flows and networks that let criminal groups operate—and it must do so under clear legal authority and oversight. That is the case Huntress co-founder and CEO Kyle Hanslovan makes in his March 16, 2026 CyberScoop opinion article. Federal policy has since moved in that direction, but the directives and authorities announced in 2026 are not proof that the criminal economy has been dismantled.
Why call cybercrime organized crime?
The phrase is most useful when it describes coordinated cyber-enabled fraud and the criminal organizations behind it—not every offense involving a computer. Hanslovan’s argument is that scam operations are sustained by more than individual attackers: they depend on supporting infrastructure and networks that allow activity to scale. If the problem is organized, his reasoning goes, the response should target the operation’s enablers as well as help potential victims defend themselves.
That is a policy argument, not a neutral finding that every cybercrime has the same structure or should be met with the same tools. Its practical challenge is to identify where disruption can impose costs on criminal operators without treating private firms as free-standing law-enforcement agencies.
What does it mean to shut down the business model?
Disrupting a criminal business model means acting at several points in the chain, rather than relying on a single arrest or a warning to consumers. The levers differ in their targets, responsible actors and safeguards:
#1 Best Overall
| Intervention | What it targets | Who acts and what is established |
|---|---|---|
| Disrupt infrastructure and supporting networks | The digital and operational enablers that let criminal activity function or scale | Hanslovan argues for private-sector cooperation with government. The March 6 executive order directs officials to review available tools and calls for appropriate use of commercial cybersecurity expertise; it does not establish completed disruption outcomes. |
| Investigate and prosecute | People and organizations responsible for serious, provable offenses | The March order directs relevant federal officials to consider prosecutions. It does not announce completed prosecutions under the order. |
| Address financial flows and victim harm | Criminal proceeds and the consequences for victims | The March order includes financial-system hardening and calls for recommendations about a victim restoration program. A recommendation process is not the same as an operating restoration program. |
| Strengthen organizational defenses | Security weaknesses criminals may exploit | Hanslovan recommends that organizations improve basic security. That is his prescription; the cited op-ed does not quantify how much any specific control reduces attacks. |
| Coordinate internationally and support local partners | Cross-border operations and resilience beyond federal agencies | The March order calls for international engagement and resilience support for state and local partners. These are stated policy tasks, not evidence that coordination has already succeeded. |
These measures are complementary, not interchangeable. Defense can make organizations harder targets, while investigation, prosecution and disruption seek to constrain criminal activity. Victim support addresses harm after it occurs; it cannot substitute for prevention or enforcement.
What did the March 2026 executive order direct?
Executive Order 14390, dated March 6, 2026, set a review-and-planning process. It directed relevant federal officials to assess operational, technical, diplomatic and regulatory tools, then submit an action plan identifying transnational criminal organizations involved in scam centers and cybercrime. The order also called for a National Coordination Center operational cell, federal information sharing and rapid response, appropriate use of commercial cybersecurity expertise, prosecutions of serious provable offenses, resilience support for state and local partners, recommendations about a victim restoration program, and international engagement.
The distinction between a directive and a result matters. The order establishes what officials were instructed to review, plan or recommend; its text alone does not show that every proposed measure was completed, that a restoration program was created, or that criminal networks were disrupted. The White House’s March 6 fact sheet reported more than $12.5 billion in consumer-reported cyber-enabled fraud losses in 2024. That is the fact sheet’s reported figure, not a measure of the order’s effects.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →What changed with the August memorandum?
A presidential memorandum dated August 12, 2026, established a National Coordination Center program authorizing participating companies to conduct specified cyber-surveillance and cyber-effects operations against foreign cyber-enabled transnational criminal organizations. The memorandum places those operations under federal control and oversight and frames them as part of lawful federal investigatory, protective or intelligence operations.
Rank #3
This is a framework for authorized activity, not evidence about how many operations have occurred or what they achieved. The existence of federal oversight is important, but the cited text does not supply outcome data with which to judge effectiveness or establish the scale of implementation.
The White House’s August 12 fact sheet reported more than $20.8 billion in consumer-reported cyber-enabled crime losses in 2025. It uses a different label from the March fact sheet’s “cyber-enabled fraud” figure for 2024. The two figures should not be presented as a like-for-like year-over-year increase: the cited passages do not provide enough methodology to establish that they measure the same category on the same basis.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What should determine whether this approach is credible?
Calls to “take the fight to the criminals” are not enough. Any proposal to involve government, private companies or foreign partners should be judged on three questions:
- What part of the criminal economy does it target? A measure aimed at infrastructure is different from one aimed at proceeds, prosecution, victim recovery or organizational defenses. Policymakers should be specific about the intended target and how the intervention is supposed to impede it.
- Who has authority and operational responsibility? Private technical expertise may contribute to an effort, but that does not make private firms public authorities. The August memorandum’s stated federal control and oversight provide a boundary for its program; the available text does not show how individual operations have been carried out.
- What legal limits and safeguards apply? Cyber operations can affect systems and people beyond the immediate target. The authorizing framework and oversight should be clear, and claims about an operation’s legality, reach or impact should be grounded in what the governing documents and verified results actually establish.
There is no outcome evidence in the cited documents that allows these approaches to be ranked by effectiveness. That makes transparency about authority, safeguards and results essential—not optional proof of success.
Best Value
What can organizations do while enforcement catches up?
Hanslovan’s op-ed also calls on organizations to address security weaknesses. That recommendation does not shift responsibility for criminal conduct onto potential victims; it recognizes that prevention is one part of a wider response. An organization can review its own security practices and incident-response readiness, while avoiding claims that any single measure will prevent cybercrime. The cited opinion does not specify a tested control set or quantify the effect of particular defenses.
Hanslovan writes: “The greater question is whether the private sector is willing to help dismantle the infrastructure that allows this industry to thrive.” It is a pointed question about willingness, but willingness alone is not a standard for success. Participation must have defined authority, safeguards and accountability, and its results must be assessed rather than assumed.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
