It isn’t a matter of if a foreign country outs a hacker who works for the US government. It’s when.

Starting near the end of the second Obama administration and rapidly escalating under Trump’s, the US has employed a tactic of “name-and-shame” in which it identifies and charges individuals who were hacking under orders of foreign governments. The idea is that the hackers will be arrested and likely extradited if they ever set foot in a country that’s friendly to the US.

As of September, when the Justice Department indicted North Korea’s Park Jin Hyok and accused him of being employed by the government when he helped hack Sony Pictures Entertainment and stole millions from the Bank of Bangladesh, the US has formally accused people of working for all four of its primary adversaries in cyberspace: China, Iran, North Korea, and Russia.

To date, none of those countries have returned the favor. But it’s just a matter of time, said Michael Daniel, who served as cybersecurity coordinator during Obama’s second term, when the Justice Department issued the first such indictment in 2014, accusing five members of China’s People’s Liberation Army of hacking Americans.

“They will,” Daniel told BuzzFeed News. “I’m shocked they haven’t already. It’s the logical thing to do, right?”

Adm. Michael Rogers, who stepped down as the director of the National Security Agency and US Cyber Command in May, said that the US only charges foreign hackers for activities that the US doesn’t engage in. China and the US both routinely spy on foreign businesses, for instance, but the US has long maintained that it’s only China that then leaks what it finds to its businesses to give them a competitive advantage.

“We certainly always acknowledged that that was a potential,” Rogers told BuzzFeed News about the prospect of other countries outing his former agencies’ elite hackers. “Our comment would be we think the activities we engage in fit within a legal framework that provides some measure of protection for those who engage in it. Other states will make the choices they make.”

The US has consistently issued that justification for its cyber activities, with little protest from the international community: While the US certainly engages in activities like hacking targets to spy on them, or occasionally to derail an adversary’s nuclear program, it claims only to create a fuss about other countries crossing a line it won’t.

But the US’s adversaries are unlikely to agree to those exact standards. In response to the Democratic Party’s ongoing lawsuit against Russia for hacking and releasing emails in 2016, for instance, Russia claimed in a letter to the court that it was the US that violates norms.

“The United States benefits significantly from the sovereign immunity that it enjoys (and US officials enjoy) in foreign courts around the world with respect to the United States' frequent acts of cyber intrusion and political interference," the letter said. "As current and former US officials have acknowledged on many occasions, the United States —acting primarily through the NSA within the US Department of Defense — is one of the most prolific practitioners of cyber attacks and cyber-intrusions on the planet."