US extradition or domestic prosecution of US based foreign cyber crime?

Question

I’m a cybersecurity professional familiar with the extradition of foreign cyber criminals to the US. But what if the situation were flipped? Given the following scenario what would likely happen?

• US citizen on US soil
• Perpetrates cyber crimes with effects in foreign countries which do not have extradition treaties with the US
• Commits no acts of “cybercrime or intellectual property crime against the interests of the United States or the citizens of the United States” (6 U.S. Code § 1531)

What is the likely legal recourse against such a person?

Perhaps:

• Do nothing?
• Would the US view such an action as a prosecutable offense?
• Can the US (or does the US) domestically prosecute individuals for crimes against foreigners committed on US soil?
• Extradite, with or without a request from that country?

Answer 1

The Computer Fraud and Abuse Act applies to "protected computers", defined amongst other things as:

[...] used in or affecting interstate or foreign commerce or communication, including a computer located outside the United States that is used in a manner that affects interstate or foreign commerce or communication of the United States [...]

The interpretation of "affecting" is very broad. AIUI if a computer sends packets over the Internet, and those packets enter the USA, then the computer has affected foreign commerce or communication of the United States. They don't need to be sent to a computer inside the USA; merely passing through a router on USA territory is sufficient, and it might even be interpreted to include a router owned by a USA company on foreign territory, as that would affect commerce. The size of the effect may be minuscule, but as long as it is not zero the computer that sent the packets is "protected".

In your scenario the foreign computer must have sent packets to the criminal, so it must have affected US communications. Hence the law enforcement authorities would have a case under the CFA. Whether they would pursue that case in practice depends on a bunch of factors, including the amount of harm done, the likely costs of conviction, and probably political factors to do with international legal cooperation.

Answer 2

Do nothing?

It happens every day. Most crimes are never prosecuted by anyone even when reported to law enforcement, especially in cyber crime, when solving the crime sufficiently to prosecute it is very difficult and costly.

Would the US view such an action as a prosecutable offense?

Usually, if there is some U.S. nexis. See the solid answer by @PaulJohnson.

Can the US (or does the US) domestically prosecute individuals for crimes against foreigners committed on US soil?

Yes.

Extradite, with or without a request from that country?

Extradition can't happen without a request from another country seeking to prosecute someone. The U.S. can deport someone to their home country, but not unilaterally extradite them to a country that hasn't asked them to do so.

The U.S. would routinely honor a request from a foreign country to extradite someone in the U.S. to that country to face cybercrime charges (even if they are U.S. citizens) if the country making the request provided some minimal evidence of the basis of its charges and was a country with a record of respecting due process of law to a reasonable extent in which criminal justice system. (Assuming that the hacking wasn't done by the U.S. government itself and the person in question was working for the U.S. government in doing so.)