Edward Dubrovsky, a 54-year-old Canadian cybersecurity executive who negotiates with ransomware gangs for a living, was arrested in the Philadelphia area on 8 October 2026. Court records cited by Reuters list conspiracy to threaten the confidentiality of information to extort money, plus interference with commerce. The underlying case sits in the Eastern District of Texas and is sealed. BleepingComputer reports that the docket also lists Hobbs Act extortion counts.
Much is unconfirmed. FBI Director Kash Patel announced the arrest of an unnamed "another suspected co-conspirator of the ShinyHunters group," but the FBI has not said that Dubrovsky is that person. KrebsOnSecurity reports that multiple sources tie the arrest to the ShinyHunters probe and that investigators suspect executives at two negotiation firms helped run ShinyHunters' "Shinywire" extortion site. The Fox report does not say whether Dubrovsky is the Shinywire figure. Dubrovsky is presumed innocent, and nothing here should be read as a finding about the firms he is associated with.
The strongest case for licensing
The argument for a licensing regime is serious. A negotiator sits in a position of unusual trust. Victims are in crisis, they usually cannot verify what the negotiator says, and the negotiator sees both the stolen data and the criminal's identity. That access creates obvious conflicts of interest. A negotiator could be paid by the victim and also have an incentive to keep the criminal business flowing, or could pass information to the gang. Nothing in the US requires a negotiator to hold a licence, carry insurance, or follow a code of conduct. If the allegations in any case prove true, advocates will say that a licence regime with background checks and fiduciary duties would have raised the cost of abuse.
Why a licence is the wrong tool
A licence regime would not have stopped the conduct charged here. Conspiracy to extort is already a federal crime, and prosecutors did not need a licensing statute to arrest a negotiator. If the allegations are true, a licence would have been one more credential for a bad actor to hold. Licensing deters little against someone prepared to commit extortion, but it does impose costs on honest firms.
Those costs fall hardest on the people who can least afford them. Most ransomware victims are small hospitals, school districts, and local governments. They use whichever incident-response firm their cyber insurer offers or whichever one is available at 2 a.m. A licensing bureaucracy, with state-by-state variation and a slow approval process, would shrink the supply of competent help exactly when attackers are fast. It would also push the weakest actors into unregulated corners, including victims negotiating alone.
The industry is also not unregulated in the way the hook implies. Treasury's Office of Foreign Assets Control issued a ransomware advisory on 1 October 2020 addressed to companies that engage with victims of ransomware attacks. It says OFAC weighs the existence and adequacy of a sanctions compliance program when deciding how to respond to violations. Sanctions liability already follows the negotiator who facilitates a payment to a designated actor, regardless of any licence.
Use the tools that already exist
The best lever is transparency, not permission. The Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) is the right frame. As proposed in CISA's rulemaking, covered entities would report a ransom payment to CISA within 24 hours and a covered incident within 72 hours. The notice of proposed rulemaking was published on 4 April 2024, and the comment period closed on 3 July 2024. CISA held town halls in June 2026, says it is still working on the final rule, and notes that multiple funding lapses have affected the rulemaking. Reporting is not yet mandatory.
That delay is the real policy failure. A working payment-reporting regime would give investigators a record of which intermediaries handled which payments, the very data that makes it possible to spot a negotiator whose clients keep getting re-extorted or whose payments flow to the same wallets. It would do this without deciding in advance who may practise.
Three narrower measures would add accountability at low cost:
- Safe-harbour for disclosure. Offer firms that report a suspected insider or conflict of interest protection from liability for that disclosure, so honest firms have an incentive to flag problems rather than hide them.
- Contractual transparency. Have federal procurement and insurer panels require negotiators to disclose fee structures, subcontractors, and any financial interest in the threat actor's infrastructure, enforced by contract rather than statute.
- Voluntary accreditation. Let industry bodies and insurers develop conduct standards and vetting, as other professional services have done, and let the market reward firms that meet them.
What to watch
The sealed docket means that the facts remain unknown, and policy should not be drafted around an allegation. If the government's theory is that negotiators ran a victim-extortion site, that is a prosecution for conspiracy and extortion, and the law reaches it. The legislative question is whether the state can see payments and conflicts early enough. Finalising CIRCIA, rather than inventing a licensing bureaucracy, answers that question better. A pro-innovation approach protects the supply of competent responders, punishes crime hard, and uses disclosure to surface bad actors.