J is for Jurisdiction — The Border That Every Harm Hides Behind

The Alphabet of Harm, letter J. A modality-bridge dossier: one entry in the OSINT archive, carried forward to what our own systems catch today, closed with a verdict — ENDED, CONTINUES, or MUTATED.

Verdict: CONTINUES.

The Meta-Letter

Every other letter in this alphabet describes a harm. This one describes the reason the harms don't stop.

Go back through the record. The Athens Affair operators (letter G) were never identified, never charged, never punished. i-SOON (letter I) sits in a Shanghai office tower, entirely beyond the reach of any court that might care. The surveillance vendors of letter C redomicile from one permissive country to the next faster than a subpoena can be drafted. The SSH botnets of letter H route through hosts chosen for one property above all others: unreachability. Different harms, different actors, different decades — and the same escape route every single time.

The escape route is the border. Harm crosses jurisdictions that the law cannot, and in the gap between where the damage lands and where the actor sits, accountability simply evaporates. Jurisdiction is not one harm among many. It is the meta-condition that lets all the others persist — the load-bearing wall of the entire threat landscape. Kick out any single actor and the wall still stands; the next actor shelters behind exactly the same border.

This is the letter about that wall: what the world built to breach it, why the breach failed, and how the failure looks when you can count it on your own sensors.

1. What the Archive Holds — The Instruments, and Their Ceiling

The archive holds humanity's serious attempts to close the gap, and — read honestly — it holds their ceiling too.

The Budapest Convention (2001). The Council of Europe's Convention on Cybercrime was the first binding international treaty built for exactly this problem: harmonize what counts as a cybercrime across borders, and create machinery for mutual legal assistance, evidence-sharing, and extradition. It was, and remains, the most serious legal instrument the world has for reaching across a border after a cyber offense. And its structural limit is the whole point of this letter: a treaty binds only its signatories. The states that host the most consequential offensive-cyber and cybercrime activity are precisely the ones that never joined, or that decline to cooperate under it. A convention the safe-haven states did not sign cannot reach the actors who shelter there. The machinery exists; the jurisdiction it needs refuses to consent.

The UN GGE norms (2021). The library holds the multilateral sequel and its softness. The UN Group of Governmental Experts produced a framework of norms of responsible state behaviour in cyberspace — resolutions on studying cybercrime, on capacity-building, on "countering the use of ICTs for criminal purposes." Every word of it is non-binding. There is no court, no compulsion, no extradition. It is a statement of what states agree they ought to do, and it is exactly as strong as each state's willingness to honour it — which, for the states the norms most need to constrain, is not very.

The state's own confession (ODNI 2024). The most damning document in the archive is not an activist's polemic; it is the United States' own intelligence community. The ODNI 2024 Annual Threat Assessment observes that cybercrime groups survive "high-profile attention, law enforcement action, or disruption of infrastructure" because they "rebrand, reconstitute, or renew their activities" — and then states the wall in plain words:

"Absent cooperative law enforcement from Russia or other countries that provide cyber criminals a safe haven or permissive environment, mitigation efforts will remain limited."

That is the whole letter in one sentence, written by the people with the most resources on Earth to do something about it. Where the actor sits in a non-cooperating state, the case ends before it begins.

Method note. The ODNI and UN GGE documents are held in the LSN library and quoted directly (HIGH confidence). The Budapest Convention is treated as the widely-documented public instrument it is; the library corroborates its theme through the UN GGE and ODNI material rather than holding the treaty text itself. We separate the archived documents from the well-known treaty they describe.

2. The Pattern Is Older Than the Internet

Impunity-by-border did not begin with cybercrime. The archive records the analog original, and it is worth naming because it strips the technology away and shows the bare mechanism.

In the Epstein files, one passage notes that as his case broke, a man of his fortune could have chosen among "dozens of countries that had no extradition treaty with the United States" and lived "an extraordinary life of comfort." That is the entire logic of the offshore-registered ASN, minus the packets: place yourself — or your infrastructure — in a jurisdiction from which the reaching hand cannot pull you back. The fugitive picks a country with no extradition treaty; the botnet operator picks an ASN registered in Seychelles. The mechanism is identical. The only thing cybercrime added was automation and scale — you no longer have to physically move to the safe country; you just register your paperwork there while operating from anywhere.

This matters because it tells us what kind of problem jurisdiction is. It is not a technical problem with a technical fix. It is a very old feature of a world carved into sovereign territories, each of which decides for itself whom it will hand over. Cybercrime industrialized the exploit, but the vulnerability is in the map, not the machine.

3. The Bridge — Counting the Arbitrage on Our Own Sensors

Here is where letter J stops being a lament and becomes measurement. The LSN entity-resolution graph exists to answer "who is whom" across contradictory sources — 943,811 entities, 1.56 million edges, 3.17 million facts, drawn from 20 independently-ranked sources. And because it records where those sources disagree, it captures the fingerprint of jurisdictional arbitrage directly.

Arbitrage leaves a specific signature: the same piece of infrastructure is described as being in different countries by different authorities, because it is registered in one place and operates in another. The graph counts these:

The 82 country-discrepancy ASNs are the clean core of it. A sample of what the graph actually holds:

Read the right-hand column and the design is obvious. Registration is chosen for the courtroom; operation happens wherever is convenient. Seychelles and Jersey are not where the servers are — they are where the lawsuit has to go, into a jurisdiction with minimal corporate transparency and no appetite to help. The gap between the registration country and the operation country is the arbitrage, and on our own graph it is not a theory. It is 82 counted ASNs and 10,850 counted addresses.

4. Bulletproof Hosting Is a Jurisdiction, Not a Datacenter

The purest commercial expression of letter J is bulletproof hosting, and our ASN risk ranking shows what it actually looks like.

The risk-score-100 bulletproof networks in our data are scattered — deliberately — across unrelated jurisdictions:

The scatter is the tell. These providers are not clustered where their customers are, or where bandwidth is cheap. They are spread across whichever legal environments are most permissive and least responsive to abuse complaints — and, in the case of CDS Global Cloud, the very registration country ("US") is itself a piece of misdirection over a China-linked operation. That last one is arbitrage doubled: a legal flag of convenience and an operational reality somewhere else entirely.

The thing being sold here is not disk and bandwidth. Bulletproof hosting is a jurisdiction-selection service. Its entire value proposition is the gap between where the abuse lands and where the server legally sits — the guarantee that a takedown request, an abuse report, a court order will die in transit between the two. When a provider advertises that it "ignores abuse complaints," what it is really advertising is a border you cannot reach across. The technology is ordinary. The product is impunity.

How a Takedown Request Actually Dies

It is worth walking the mechanism concretely, because "jurisdictional gap" is an abstraction until you follow a single abuse complaint to its grave. Trace what happens when a defender does everything right against an offshore-registered attack host.

First, the defender identifies the malicious IP and looks up its abuse contact. The contact resolves to the registered entity — say, a company in Seychelles. The defender files a complaint. In a cooperative jurisdiction, that complaint reaches a provider legally exposed to abuse regulation, and something happens. Against a bulletproof host, the complaint reaches a shell whose entire business model is to ignore it; there is no regulator behind the address to escalate to. Dead end one.

So the defender escalates to law enforcement. Their national police can act domestically, but the server is abroad, so they must issue a Mutual Legal Assistance request — the formal machinery the Budapest Convention was built to grease. That request must travel to the government of the country where the infrastructure legally sits. If that government is a non-signatory, or a signatory that simply does not answer, the MLAT request enters a queue that, in the best documented cases, runs to months or years — and in the safe-haven cases, never returns at all. Dead end two.

Meanwhile the operator, watching none of this with any concern, has rotated the campaign to a fresh IP on a different bulletproof ASN in a third country, and the whole process must begin again from zero against a new set of borders. The defender's diligence was never the bottleneck. The bottleneck is that every step of the escalation crosses a line of sovereignty, and at each line the process can be — and against a well-chosen jurisdiction, will be — simply not received. The arbitrage does not defeat the law by breaking it. It defeats the law by placing itself where the law politely stops.

5. What Our Systems Actually Hold — And What They Can't

Honesty about scope, as in every letter. Letter J is unusual because our systems catch the shape of the problem clearly while being powerless over its cause.

What we hold, and hold well: the measurement. We can count the 82 arbitrage ASNs and the 10,850 org-mismatch IPs. We can map bulletproof providers to their jurisdictions of convenience. We can watch, on live telemetry, an actor register in Seychelles and operate from Amsterdam. The entity graph makes the arbitrage legible — turns "they hide behind borders" from a slogan into a query that returns rows. That is real, and it is more than most defenders have.

What we cannot do: anything about the cause. We cannot extradite. We cannot compel a safe-haven state to cooperate. We cannot serve process across a border that will not receive it. The ODNI, with the entire apparatus of a superpower, concedes that mitigation "will remain limited" without cooperation that is not coming — and a honeypot in Iași is under no illusion that it can do what the ODNI cannot. The measurement is our ceiling.

So the honest statement of the LSN role in letter J is narrow and specific: we make the arbitrage visible, and at our own edge we route around it. Blocking at the perimeter — CrowdSec decisions, MikroTik address-lists, dropping the traffic regardless of whose court it should theoretically go to — is the one remedy that does not require anyone's cooperation. When you cannot reach across the border to the actor, you can still refuse the actor at your own door. That is not justice. It is the substitute a defender is left with when justice is jurisdictionally out of reach.

6. Why This Letter Is the Keystone

Pull letter J out and the whole alphabet collapses into it.

The surveillance letters (C, G) end in impunity because the vendors and operators sit where no court reaches. The espionage letter (I) ends in impunity because i-SOON is in China. The automation letter (H) is relentless because the botnet hosts are jurisdictionally untouchable. Even the letters still to come — ransomware, the state-hacking programs, the archives of the powerful — will resolve, at their base, to the same fact: the harm crossed a border the consequence could not.

This is why the alphabet exists in the form it does. If the perpetrators could be reached, the correct response to each letter would be an indictment, not a dossier. The dossier is what you write when the courtroom is unreachable. Exposure — naming the pattern, holding the record, making the arbitrage legible — is the lever that remains when the legal levers are jammed by geography. Letter J is the letter that explains why every other letter is a dossier and not a charge sheet. It is the keystone: remove it, and the reason for the whole project falls out.

That is not a counsel of despair. Making a harm legible is not nothing — it raises the cost of the arbitrage, feeds the sanctions and takedowns that are occasionally possible, and denies the actor the one thing the border was supposed to buy: invisibility. The safe-haven state can refuse extradition. It cannot refuse the record.

The Lever That Does Move

If extradition is jammed and MLATs die in queues, it would be easy to conclude that nothing works — and that conclusion would be wrong. There is one lever that does not require the safe-haven state's consent, and it is the reason this alphabet is worth writing at all: attribution feeding consequence that routes around the border.

The state cannot always reach the actor, but it can act on everything the actor touches that does cross into a cooperating jurisdiction. Sanctions designate the individuals and companies, freezing whatever assets and access pass through the reachable financial system. Coordinated infrastructure takedowns seize the domains and servers that happen to sit in cooperating countries, even when the operators do not. Indictments-in-absentia, however unenforceable today, convert a free traveller into someone who can be arrested the moment they set foot outside their shelter — a lifelong narrowing of the world. None of these reach into the safe haven. All of them raise the cost of living in it.

Every one of those levers runs on the same fuel: a legible, evidenced record of who did what. A sanction needs a name; a takedown needs an infrastructure map; an indictment needs a case. That is precisely what a dossier is, and precisely what the entity graph produces when it turns 82 country-discrepancy ASNs and 10,850 org-mismatches from noise into a named, queryable structure. The measurement that cannot itself extradite anyone is the raw material for every consequence that can be applied without extradition. Visibility is not the remedy — but it is the thing the remedies are made of, and it is the one part of the chain a defender at the edge can actually contribute. The safe-haven state can refuse the reaching hand. It cannot un-write the record that makes the hand worth extending.

7. What We Claim and Refuse

Precision about the limits, because this letter reasons about law as much as packets.

What is HIGH confidence: the ODNI and UN GGE quotations (held in the library, quoted verbatim). The 82 country-discrepancy ASNs, the 10,850 org-mismatch IPs, and the 60,185 total conflicts (our own direct graph measurements). The scatter of risk-100 bulletproof ASNs across IT/PK/BR/US (our own risk ranking).

What is MEDIUM or inferred: the intent behind any single arbitrage. A GB-registered ASN operating from Bulgaria is a discrepancy; whether it is deliberate laundering or a benign multinational's messy paperwork requires case-by-case work, and some fraction of the 82 will be innocent. We claim the population is a strong signal of arbitrage; we do not claim every member is guilty. Likewise the "bulletproof" label is a risk assessment, not a criminal finding.

What we refuse: to pretend the measurement is a remedy. Counting the arbitrage is not closing it, and this letter does not dress up visibility as victory. We hold the record and route around the harm at our edge. The cause — the safe-haven consent problem — is beyond our sensors, beyond our reach, and, for now, beyond the ODNI's too. Saying so plainly is part of the work.

8. The Verdict — CONTINUES

The Budapest Convention set out, in 2001, to close the accountability gap. Twenty-five years later the gap is open — and, by the intelligence community's own admission, structurally so. Not because the world failed to build the instruments; the treaty exists, the norms exist, the machinery exists. The gap persists because the states hosting the most consequential activity decline to be bound, and no instrument can extradite from a country that will not sign. The bottleneck was never legal. It was, and remains, political consent — and consent has not moved.

If anything, the exploitation has hardened. What was once a fugitive fleeing to a no-extradition country is now a routine, automated arbitrage: register the ASN offshore, announce it from somewhere else, launder the operator through three jurisdictions, buy bulletproof hosting whose product is the border. The harm-enabler did not end, and it did not merely persist unchanged — it professionalized into infrastructure you can count on a graph. But its essence is exactly what it was in 2001: impunity purchased with a border.

That is the definition of CONTINUES, and it is the gravest CONTINUES in the alphabet, because this is the letter the others depend on. Every harm that escaped, escaped here. Until the safe-haven consent problem changes — and nothing in the archive suggests it is about to — exposure remains the main lever a defender actually holds. Which is precisely why this alphabet is written the way it is: not to prosecute, because we cannot, but to make the pattern impossible to un-see.

Verdict: CONTINUES — jurisdiction is the border every harm hides behind, and it is exactly as open today as it was the day the treaty meant to close it was signed.

The Alphabet of Harm is a modality-bridge series: each letter takes one entry from the OSINT archive — truth as it was recorded at the time — and carries it forward to what the LSN sensor mesh, honeypot, and web-threat telemetry catch today, then closes with a verdict. We include what the record and the vectors show. We do not judge; we let the reader judge. J is for Jurisdiction. Next: K.