5 ms·

IMO, it should be illegal to pay ransomware. Bad actors only deploy ransomware because enough people pay the ransom for it to be worthwhile. Raise the minimum r

IMO, it should be illegal to pay ransomware. Bad actors only deploy ransomware because enough people pay the ransom for it to be worthwhile. Raise the minimum risk-adjusted price (chance of getting caught paying * fine) by enough, and people will make the rational decision to not pay it. Combine with an advertising campaign to make it common knowledge that paying ransomware gets you fined, and that you should have good backup-and-restore ability instead, and the problem should become much less intense. (side note: paying ransomware has negative externalities, since it funds ransomware operations that hurt others. If criminalizing it offends your libertarian aesthetic, think of it as a Pigouvian tax instead.)

jstanley 9y ago
> Raise the minimum risk-adjusted price (chance of getting caught paying * fine) by enough, and people will make the rational decision to not pay it. You don't need to make it illegal to pay ransomware to use this type of logic to stop ransomware. Here's an alternative version: It should be illegal to deploy ransomware. Raise the minimum risk-adjusted price (chance of getting caught deploying * fine) by enough, and people will make the rational decision not to deploy it. But it doesn't work. The chance of getting caught is (currently) so infinitesimal that it is ignored, and ransomware is rampant. In your system, the chance of getting caught paying would be equally infinitesimal, with the added problem that anybody involved with prosecuting or convicting would fully understand that they are harming the victim rather than the perpetrator.
- wtvanhest 9y ago
  That definitely is not true. If a company has to pay $1m for ransomware, they would likely need to disclose it publicly, and at least privately to auditors. Making it illegal as in jail time would prevent any corporate employee from agreeing to do it so it would effectively stop it.
  - jstanley 9y ago
    Fair point.
- paulgb 9y ago
  The ransomers are likely in another country which makes it harder to prosecute them.
- deleted 9y ago
  [deleted]
dorfsmay 9y ago
We don't even know of all the attacks (because it makes the victim look bad), adding a fine would drive reporting down even more. Legislate proper security more, enforce it, fund an electronic police to help combat it.
noonespecial 9y ago
It has negative externalities? Don't make it illegal. Tax it to hell. $50k minimum plus 700% of the ransom paid ought to cover it. Dodging those taxes and trying to pay secretly, now that's illegal. The taxes paid by the desperate and careless can be used for the expensive international cases against the scammers.
mikeash 9y ago
I'm sure this would work just as well as outlawing ransomware itself has worked.
vkou 9y ago
There's a simple problem with your proposal. Unless the entire world adopts this legislature in lock-step, there will still be incentives for ransomware authors to infect systems. So what if French, Spanish, and American victims are legally prohibited from paying, if there's still money to be made in India, Australia, and Ireland? Because the marginal cost of vulnerability exploitation is very low, what will end up happening is ransomware distributors will remain in business, and French, Spanish, and American companies will now not be able to recover any lost data. While their Irish counterparts pay the extorters, fix their systems, and move on with their lives.
- ThrustVectoring 9y ago
  There's opportunity costs for engaging in ransomware rather than doing other activities. If you're good enough with computers to do ransomware, you're also probably good enough with computers to do legitimate work. We don't need to completely starve out the ransomware actors, we just need to make it less lucrative than their other alternatives. There's still a problem - nothing's stopping India, Australia, and Ireland in your example from benefitting from the reduction in ransomware without paying the costs for disincentivizing it. Free riders are a problem for public goods, such as low-crime environments.
castis 9y ago
Lets say I run any given hosting company. Someone using a zero-day exploit gets in and encrypts everything that runs my company and demands a ransom in exchange for the key. Using your logic, my government says I'm not allowed to take measures to get my company back in order. Why should we further expand the power of the government to make an already shitty situation even more detrimental?
- ThrustVectoring 9y ago
  It's situations versus strategies. Making certain kinds of situations worse will make people choose better strategies. This is one solution to the Prisoner's Dilemma - if you defect, the mob boss puts a hit out on you, so nobody talks.
  - castis 9y ago
    If something such as that were implemented, sure you'd stop a few, but it would just become an underreported metric. Making something illegal does not wholesale stop it from happening, it just pushes it out of view.
    - ThrustVectoring 9y ago
      It'd at least put a significant dent in public corporation's spending on it. If they share it in their audits and reports to shareholders, they get nailed on paying ransomware. If they hide that they paid out significant amounts of money, that's accounting and/or securities fraud. The biggest sensible course of action is to put the IT infrastructure in place that mitigates ransomware attacks.
  - alexbeloi 9y ago
    The natural response for the attacker is to discount the ransom amount to compensate for the expected cost of penalties (from breaking the law). This will deter attacks if the expected penalty is greater than than the ransom amount, but anywhere less than that, the government just becomes a co-conspirator in the ransom.
desdiv 9y ago
Kidnapping has been around for thousands of years, and yet so far no jurisdiction managed to criminalize paying the kidnapping ransom.
- blue1 9y ago
  In Italy in the event of a kidnapping all the assets belonging to the kidnapped person and his/her family are immediately frozen by the law. As a consequence, paying the ransom effectively becomes a crime.
  - desdiv 9y ago
    I stand corrected. Thank you for the correction.
  - bgun 9y ago
    Are there statistics on before/after this law was implemented? It seems that kidnapping would become massively underreported as a result.
    - blue1 9y ago
      Kidnappings in Italy are now much rarer than they used to be (see: <https://en.wikipedia.org/wiki/Anonima_sarda> https://en.wikipedia.org/wiki/Anonima_sarda>). I have no idea in what measure it depends on the asset-freezing law.
toast0 9y ago
That means that if I want to pay the ransomware, I also have to pay the (ongoing?) blackmail fee so the ransomware installer doesn't tell anyone I paid the ransom?

jstanley 9y ago

> Raise the minimum risk-adjusted price (chance of getting caught paying * fine) by enough, and people will make the rational decision to not pay it. You don't need to make it illegal to pay ransomware to use this type of logic to stop ransomware. Here's an alternative version: It should be illegal to deploy ransomware. Raise the minimum risk-adjusted price (chance of getting caught deploying * fine) by enough, and people will make the rational decision not to deploy it. But it doesn't work. The chance of getting caught is (currently) so infinitesimal that it is ignored, and ransomware is rampant. In your system, the chance of getting caught paying would be equally infinitesimal, with the added problem that anybody involved with prosecuting or convicting would fully understand that they are harming the victim rather than the perpetrator.

wtvanhest 9y ago
That definitely is not true. If a company has to pay $1m for ransomware, they would likely need to disclose it publicly, and at least privately to auditors. Making it illegal as in jail time would prevent any corporate employee from agreeing to do it so it would effectively stop it.
- jstanley 9y ago
  Fair point.
paulgb 9y ago
The ransomers are likely in another country which makes it harder to prosecute them.
deleted 9y ago
[deleted]

dorfsmay 9y ago

We don't even know of all the attacks (because it makes the victim look bad), adding a fine would drive reporting down even more. Legislate proper security more, enforce it, fund an electronic police to help combat it.

noonespecial 9y ago

It has negative externalities? Don't make it illegal. Tax it to hell. $50k minimum plus 700% of the ransom paid ought to cover it. Dodging those taxes and trying to pay secretly, now that's illegal. The taxes paid by the desperate and careless can be used for the expensive international cases against the scammers.

mikeash 9y ago

I'm sure this would work just as well as outlawing ransomware itself has worked.

vkou 9y ago

There's a simple problem with your proposal. Unless the entire world adopts this legislature in lock-step, there will still be incentives for ransomware authors to infect systems. So what if French, Spanish, and American victims are legally prohibited from paying, if there's still money to be made in India, Australia, and Ireland? Because the marginal cost of vulnerability exploitation is very low, what will end up happening is ransomware distributors will remain in business, and French, Spanish, and American companies will now not be able to recover any lost data. While their Irish counterparts pay the extorters, fix their systems, and move on with their lives.

ThrustVectoring 9y ago
There's opportunity costs for engaging in ransomware rather than doing other activities. If you're good enough with computers to do ransomware, you're also probably good enough with computers to do legitimate work. We don't need to completely starve out the ransomware actors, we just need to make it less lucrative than their other alternatives. There's still a problem - nothing's stopping India, Australia, and Ireland in your example from benefitting from the reduction in ransomware without paying the costs for disincentivizing it. Free riders are a problem for public goods, such as low-crime environments.

castis 9y ago

Lets say I run any given hosting company. Someone using a zero-day exploit gets in and encrypts everything that runs my company and demands a ransom in exchange for the key. Using your logic, my government says I'm not allowed to take measures to get my company back in order. Why should we further expand the power of the government to make an already shitty situation even more detrimental?

ThrustVectoring 9y ago
It's situations versus strategies. Making certain kinds of situations worse will make people choose better strategies. This is one solution to the Prisoner's Dilemma - if you defect, the mob boss puts a hit out on you, so nobody talks.
- castis 9y ago
  If something such as that were implemented, sure you'd stop a few, but it would just become an underreported metric. Making something illegal does not wholesale stop it from happening, it just pushes it out of view.
  - ThrustVectoring 9y ago
    It'd at least put a significant dent in public corporation's spending on it. If they share it in their audits and reports to shareholders, they get nailed on paying ransomware. If they hide that they paid out significant amounts of money, that's accounting and/or securities fraud. The biggest sensible course of action is to put the IT infrastructure in place that mitigates ransomware attacks.
- alexbeloi 9y ago
  The natural response for the attacker is to discount the ransom amount to compensate for the expected cost of penalties (from breaking the law). This will deter attacks if the expected penalty is greater than than the ransom amount, but anywhere less than that, the government just becomes a co-conspirator in the ransom.

desdiv 9y ago

Kidnapping has been around for thousands of years, and yet so far no jurisdiction managed to criminalize paying the kidnapping ransom.

blue1 9y ago
In Italy in the event of a kidnapping all the assets belonging to the kidnapped person and his/her family are immediately frozen by the law. As a consequence, paying the ransom effectively becomes a crime.
- desdiv 9y ago
  I stand corrected. Thank you for the correction.
- bgun 9y ago
  Are there statistics on before/after this law was implemented? It seems that kidnapping would become massively underreported as a result.
  - blue1 9y ago
    Kidnappings in Italy are now much rarer than they used to be (see: <https://en.wikipedia.org/wiki/Anonima_sarda> https://en.wikipedia.org/wiki/Anonima_sarda>). I have no idea in what measure it depends on the asset-freezing law.

toast0 9y ago

That means that if I want to pay the ransomware, I also have to pay the (ongoing?) blackmail fee so the ransomware installer doesn't tell anyone I paid the ransom?