Prescott Valley, AZ Correspondent — When a pipeline stops and a meat packer stops, you’re not in a fraud unit anymore. You’re in a country that just learned a criminal group can ration fuel and supper.

Criminal casework still matters — attribution, the wallet, the employee who opened the attachment. What can’t stay is the idea that the sovereign response is a press conference and a private negotiation. Private negotiations publish a price list.

Treat it as a security matter when the target is fuel, food, water, power, or hospitals at regional scale. Leave ordinary extortion in the criminal box.

I’d note that some of this is already moving. The Department recovered most of the Colonial ransom in June by tracing the wallet, which is the criminal tool working better than anyone expected. That’s an argument for funding both halves rather than choosing.

Novi, MI Correspondent — A plant that can’t get parts because a packer is down isn’t a cybersecurity awareness campaign.

Both of those were production events, and production events at that scale are security events regardless of the tool.

The threshold should be published: fuel, food, water, grid, ports, hospitals when the outage is regional. Regional is the word, and regional is what made people put cans in a Civic.

What I’d add from two days ago — the Kaseya compromise over the weekend hit hundreds of businesses at once through a single software supplier. That’s a different shape from Colonial. It’s not one target, it’s a channel, and a channel that reaches a thousand small firms is a systemic event assembled out of individually unimportant victims.

The doctrine has to cover that or it’ll cover the last war.

Orange County, CA Correspondent — Orange County felt Colonial in a line and JBS in a price.

Necessary but not sufficient is the honest answer on criminal treatment. Yes to a security designation when the target is a system the public can’t substitute in a weekend.

I’d flag the insurance dimension because it’s driving behavior more than policy is. Cyber insurance has been paying ransoms, which is rational for each individual policyholder and has functioned as a subsidy to the market. Premiums have roughly doubled and several carriers are pulling back or excluding ransom payment entirely.

That withdrawal will do more to change firm behavior in the next year than any federal doctrine, and it’ll do it by leaving a lot of mid-size companies exposed. Somebody should be planning for that.

Bismarck, ND Correspondent — If they can shut a pipe and a packer, it isn’t just a case file.

JBS matters here in a way it didn’t elsewhere. A packing plant going down for days moves the cattle market, and a rancher who can’t ship on schedule doesn’t get that week back. Agriculture is critical infrastructure and it’s designated as such, and almost nobody treats it that way.

Grain cooperatives run on software bought from three vendors. If somebody wants to demonstrate the point during harvest, the demonstration is available.

Jacksonville, FL Correspondent — A port already has a physical threat model. This is the same model with a worse door, and we’ve had the demonstration — Maersk lost most of a shipping network to a wiper in 2017 and it cost them hundreds of millions.

Yes to a security designation when the outage rations a region’s fuel or a nation’s protein or a harbor’s ability to move.

The president gave the Russians a list of sixteen critical sectors at Geneva three weeks ago and said attacks on them would be answered. That’s a threshold whether anyone intended it as one. Now it has to mean something the next time a crew inside that jurisdiction hits a listed sector, or it’s worse than not having said it.

Long Island, NY Correspondent — I draft incident annexes, and an annex that stops at “call the Bureau and the carrier” is complete for a law firm and incomplete for a pipeline.

The legal cleanliness of treating it as ordinary crime is attractive precisely because it avoids hard authority questions. Avoidance isn’t a strategy when the leverage is supper and gasoline.

I’d want three things written down. A threshold defined by sector and outage scale. A playbook that specifies who is in the room above that threshold. And honest guidance on payment, because the current position — payment is discouraged but not prohibited and please call us — is the worst available, since it neither stops the market nor helps the firm.

Colonial paid within hours. Whatever we say about that, the incentive structure produced it.

Cheyenne, WY Correspondent — Pipe and protein aren’t a detective story.

Security event. Offensive options against the crew and the jurisdiction that shelters them. The Bureau still works the wallet, and it worked it well in June.

Firms patch. The country imposes a cost. Two exhibits is enough to write the doctrine.

Sydney, Australia Correspondent — We eat this problem too, and I’d offer the number rather than the sentiment: our own agencies took reports of a ransomware incident against Australian entities roughly every eight hours last year, and one of ours took down a large meat processor as well.

Criminal-only is the model that left every hospital and shipper to bargain alone.

What I’d say about the offensive half is that it works better shared. Attribution is easier with more collection, disruption is easier with more jurisdictions, and a threshold that only the United States observes is a threshold criminals route around.

We’ve legislated to give our signals agency more room to act against these networks and it’s been contentious here for the reasons you’d expect. It’s still the right direction, and the coordination is the part that hasn’t been built.