8 ms·

You're right, they didn't outright give a hard "no," but the story gets more interesting after New Bedford's counter offer. By attempting to negotiate, the city

You're right, they didn't outright give a hard "no," but the story gets more interesting after New Bedford's counter offer. By attempting to negotiate, the city bought valuable time that they used to harden and restore their systems.

hartator 7y ago
Yes, but my understanding of the article is the city was negotiating in good faith. They were willing to pay the $400k. Still a lot of money.
- logicallee 7y ago
  Any reason laws can't be introduced making it highly illegal to pay a ransom, with serious criminal repercussions (same for government officials doing so)? After all paying a ransom is very literally funding terrorism, in the most direct possible way. "Whosoever knowingly pays a ransom", etc. Of course those seeking a ransom could make their language less and less clear, so it's no longer clearly a ransom. But isn't that still an improvement over the status quo? Maybe I'm missing something, but I don't see why it should be legal to pay.
  - TaExtra 7y ago
    >After all paying a ransom is very literally funding terrorism, in the most direct possible way. Not everything is related to terrorism.
  - parsimo2010 7y ago
    Because you shouldn't criminalize being a victim. I agree that it's probably a bad idea to pay a ransom, since that just supports the success rate and makes ransomware more popular. But do you really think that you should throw a grandparent in jail because paying a ransom is the only way they can get their digital memories back? Are you going to throw all of City Hall in jail because they needed to pay to get their tax records back? The best option is to have good backups and not give into the demands, and that should be encouraged. But criminalizing people because they didn't adhere to the best digital practices is a bad idea.
    - paulryanrogers 7y ago
      For private individuals perhaps it shouldn't be criminal. But for businesses responsible for other people's private information? Yes, I think there is professional negligence if they cannot even restore backups in a timely manner. (Or cannot detect infections before they become so widespread the whole thing falls down.)
      - logicallee 7y ago
        The part I would criminalize is the money-wiring part.
      - parsimo2010 7y ago
        The action that a business should be punished for is not keeping their customer's information secure. Paying a ransom to recover after they are the victim of a crime should not be what they are punished for. If they were doing everything right but still got hit by ransomware I don't think they should be punished. If you can prove that they wrote their login info on a sticky note and left it in the main lobby then you should punish the bad security practice if it exposes other people's information. Several parts of the world have kidnapping and piracy issues, and you can buy kidnapping/piracy insurance to pay ransoms in case you are the victim of such a crime. I think most people in the world acknowledge that sometimes bad things happen even when you take reasonable precautions, and you shouldn't be punished just because you were the unlucky one. Most security experts agree that no computer system is un-crackable, there are just varying levels of sophistication and access needed to do so. We've even seen that Stuxnet was capable of jumping air gaps. If a business had such good security that their database and backups were air-gapped but still was hit by ransomware do you think that they should still be fined?
        tempguy9999 7y ago
        > If they were doing everything right but still got hit by ransomware Then I'd say there weren't doing things right. Granted there should be exceptions for when they really did do their best, but generally no. > Most security experts agree that no computer system is un-crackable It doesn't have to be, merely needs being not worth the effort to the criminals.
  - testvox 7y ago
    So many innocent people pay ransoms. Any politician who pushed though that law would get destroyed by the press the first time the government imprisons some sympathetic person who panicked and paid a ransom to keep their nudes from being sent to their family.
    - C1sc0cat 7y ago
      Or the government has a word with the Tabloids who would love to run headlines "CELEB X'S KINKY SEX TAPES..."
  - dsfyu404ed 7y ago
    >Any reason laws can't be introduced making it highly illegal to pay a ransom, with serious criminal repercussions (same for government officials doing so)? Technically no, but pigs will fly and the state police will stop abusing the overtime system first. Massachusetts is not known for passing laws that reduce the ability of government officials to do as they see fit and of the possible reasons to pass such a law "we gotta be responsible with taxpayer money" would have everyone crying with laughter on beacon hill. The idea of criminalizing paying a ransom for the common man is bad for reasons other commenters have stated. There is exactly zero chance of MA making it illegal for the government to do something peasants can do.
  - Iv 7y ago
    Before Sarkozy, that was France policy for hostage takers: the only thing you will receive is the GIGN. Caused a few loss but was generally considered an overall good strategy. Then Sarkozy started paying ransoms and abducting French in war zones started being profitable instead of calling for trouble.
  - msie 7y ago
    I’ve seen too many laws passed with the best of intentions but lead to the imprisonment of the wrong people.
  - jonathanstrange 7y ago
    > Any reason laws can't be introduced making it highly illegal to pay a ransom Yes, there are many reasons. You seem to adopt a highly deontological ethical stance. But in actual decision making, being pragmatic, showing some grace by being human and making hard compromises, and at the same time being utilitarian are often more rewarding. For example, governments all over the world have (often secretly) paid ransom money for kidnapped citizens. If they couldn't do that any longer, because it is illegal, then that would doom the fate of many kidnapped citizens. Elected officials should make reasonable decisions that minimize harm and costs and should be willing to make compromises, not brag with their iron fist policies no matter what the consequences are. (That's just my personal opinion, of course.) > After all paying a ransom is very literally funding terrorism Do you have any proof for that claim? If not, then you are merely watering down the meaning of the word "terrorism". AFAIK, these ransomware attacks are conducted by ordinary criminals, not by terrorists.
    - jstanley 7y ago
      He's saying that the ransomware attack is itself a terrorist attack.
      - gambiting 7y ago
        Sure, but he's also saying that paying any ransom should always be illegal. To completely overexaggorate - if after hitting the first tower of World Trade Centre the terrorists said "pay us $100M or we'll hit the other building" then the logical solution is to make sure they get that $100M immediately. They have already demonstrated the ability to hit one building and kill hundreds of people by doing so - whatever price they name for preventing the second attack should be paid. Of course, we need to apply good sense to this - whole paying ransom to save human lives is a good idea, we can have a discussion about paying ransom to save computer systems. I can see an argument being made that if it isn't paid, the city's welfare system stops working and the people in most need do not get the support they require - so resolving the situation quicker by paying the ransom can be the moral thing to do.
        7y ago
  - eru 7y ago
    Switzerland has such laws.
  - logicallee 7y ago
    For anyone still reading this, I found this interesting article summarizing some of the subject: https://www.ibanet.org/Article/NewDetail.aspx?ArticleUid=780fdf19-16ae-4f32-8b2b-984806ef55ff https://www.ibanet.org/Article/NewDetail.aspx?ArticleUid=780...
- deleted 7y ago
  [deleted]
solidasparagus 7y ago
That didn't make sense to me. What did negotiating actually buy them? I don't see any indication that the attackers paused the attack.
- rdc12 7y ago
  Little to gain in restoring from backup if the same attack vector is still open. So it was really just a bit of misdirection.
- blaser-waffle 7y ago
  It bought them time to figure out the root cause, fix it, and check if restoring backups is a viable option. Smart play.
rolltiide 7y ago
Restoring a backup they already had? Get outta here
rebuilder 7y ago
That sounds like whitewashing to me, to be honest: The city were willing to pay a ransom, and are now trying to make it sound like a shrewd move instead of negotiating with criminals.

hartator 7y ago

Yes, but my understanding of the article is the city was negotiating in good faith. They were willing to pay the $400k. Still a lot of money.

logicallee 7y ago
Any reason laws can't be introduced making it highly illegal to pay a ransom, with serious criminal repercussions (same for government officials doing so)? After all paying a ransom is very literally funding terrorism, in the most direct possible way. "Whosoever knowingly pays a ransom", etc. Of course those seeking a ransom could make their language less and less clear, so it's no longer clearly a ransom. But isn't that still an improvement over the status quo? Maybe I'm missing something, but I don't see why it should be legal to pay.
- TaExtra 7y ago
  >After all paying a ransom is very literally funding terrorism, in the most direct possible way. Not everything is related to terrorism.
- parsimo2010 7y ago
  Because you shouldn't criminalize being a victim. I agree that it's probably a bad idea to pay a ransom, since that just supports the success rate and makes ransomware more popular. But do you really think that you should throw a grandparent in jail because paying a ransom is the only way they can get their digital memories back? Are you going to throw all of City Hall in jail because they needed to pay to get their tax records back? The best option is to have good backups and not give into the demands, and that should be encouraged. But criminalizing people because they didn't adhere to the best digital practices is a bad idea.
  - paulryanrogers 7y ago
    For private individuals perhaps it shouldn't be criminal. But for businesses responsible for other people's private information? Yes, I think there is professional negligence if they cannot even restore backups in a timely manner. (Or cannot detect infections before they become so widespread the whole thing falls down.)
    - logicallee 7y ago
      The part I would criminalize is the money-wiring part.
    - parsimo2010 7y ago
      The action that a business should be punished for is not keeping their customer's information secure. Paying a ransom to recover after they are the victim of a crime should not be what they are punished for. If they were doing everything right but still got hit by ransomware I don't think they should be punished. If you can prove that they wrote their login info on a sticky note and left it in the main lobby then you should punish the bad security practice if it exposes other people's information. Several parts of the world have kidnapping and piracy issues, and you can buy kidnapping/piracy insurance to pay ransoms in case you are the victim of such a crime. I think most people in the world acknowledge that sometimes bad things happen even when you take reasonable precautions, and you shouldn't be punished just because you were the unlucky one. Most security experts agree that no computer system is un-crackable, there are just varying levels of sophistication and access needed to do so. We've even seen that Stuxnet was capable of jumping air gaps. If a business had such good security that their database and backups were air-gapped but still was hit by ransomware do you think that they should still be fined?
      - tempguy9999 7y ago
        > If they were doing everything right but still got hit by ransomware Then I'd say there weren't doing things right. Granted there should be exceptions for when they really did do their best, but generally no. > Most security experts agree that no computer system is un-crackable It doesn't have to be, merely needs being not worth the effort to the criminals.
- testvox 7y ago
  So many innocent people pay ransoms. Any politician who pushed though that law would get destroyed by the press the first time the government imprisons some sympathetic person who panicked and paid a ransom to keep their nudes from being sent to their family.
  - C1sc0cat 7y ago
    Or the government has a word with the Tabloids who would love to run headlines "CELEB X'S KINKY SEX TAPES..."
- dsfyu404ed 7y ago
  >Any reason laws can't be introduced making it highly illegal to pay a ransom, with serious criminal repercussions (same for government officials doing so)? Technically no, but pigs will fly and the state police will stop abusing the overtime system first. Massachusetts is not known for passing laws that reduce the ability of government officials to do as they see fit and of the possible reasons to pass such a law "we gotta be responsible with taxpayer money" would have everyone crying with laughter on beacon hill. The idea of criminalizing paying a ransom for the common man is bad for reasons other commenters have stated. There is exactly zero chance of MA making it illegal for the government to do something peasants can do.
- Iv 7y ago
  Before Sarkozy, that was France policy for hostage takers: the only thing you will receive is the GIGN. Caused a few loss but was generally considered an overall good strategy. Then Sarkozy started paying ransoms and abducting French in war zones started being profitable instead of calling for trouble.
- msie 7y ago
  I’ve seen too many laws passed with the best of intentions but lead to the imprisonment of the wrong people.
- jonathanstrange 7y ago
  > Any reason laws can't be introduced making it highly illegal to pay a ransom Yes, there are many reasons. You seem to adopt a highly deontological ethical stance. But in actual decision making, being pragmatic, showing some grace by being human and making hard compromises, and at the same time being utilitarian are often more rewarding. For example, governments all over the world have (often secretly) paid ransom money for kidnapped citizens. If they couldn't do that any longer, because it is illegal, then that would doom the fate of many kidnapped citizens. Elected officials should make reasonable decisions that minimize harm and costs and should be willing to make compromises, not brag with their iron fist policies no matter what the consequences are. (That's just my personal opinion, of course.) > After all paying a ransom is very literally funding terrorism Do you have any proof for that claim? If not, then you are merely watering down the meaning of the word "terrorism". AFAIK, these ransomware attacks are conducted by ordinary criminals, not by terrorists.
  - jstanley 7y ago
    He's saying that the ransomware attack is itself a terrorist attack.
    - gambiting 7y ago
      Sure, but he's also saying that paying any ransom should always be illegal. To completely overexaggorate - if after hitting the first tower of World Trade Centre the terrorists said "pay us $100M or we'll hit the other building" then the logical solution is to make sure they get that $100M immediately. They have already demonstrated the ability to hit one building and kill hundreds of people by doing so - whatever price they name for preventing the second attack should be paid. Of course, we need to apply good sense to this - whole paying ransom to save human lives is a good idea, we can have a discussion about paying ransom to save computer systems. I can see an argument being made that if it isn't paid, the city's welfare system stops working and the people in most need do not get the support they require - so resolving the situation quicker by paying the ransom can be the moral thing to do.
      - 7y ago
- eru 7y ago
  Switzerland has such laws.
- logicallee 7y ago
  For anyone still reading this, I found this interesting article summarizing some of the subject: https://www.ibanet.org/Article/NewDetail.aspx?ArticleUid=780fdf19-16ae-4f32-8b2b-984806ef55ff https://www.ibanet.org/Article/NewDetail.aspx?ArticleUid=780...
deleted 7y ago
[deleted]

solidasparagus 7y ago

That didn't make sense to me. What did negotiating actually buy them? I don't see any indication that the attackers paused the attack.

rdc12 7y ago
Little to gain in restoring from backup if the same attack vector is still open. So it was really just a bit of misdirection.
blaser-waffle 7y ago
It bought them time to figure out the root cause, fix it, and check if restoring backups is a viable option. Smart play.

rolltiide 7y ago

Restoring a backup they already had? Get outta here

rebuilder 7y ago

That sounds like whitewashing to me, to be honest: The city were willing to pay a ransom, and are now trying to make it sound like a shrewd move instead of negotiating with criminals.