7 ms·
Why not make it a crime to pay the ransom demand for cryptolocker attacks? This way the flow of money to these gangsters will stop. If you get hit with a crypt
by quickthrower2 7y ago
Why not make it a crime to pay the ransom demand for cryptolocker attacks? This way the flow of money to these gangsters will stop.
If you get hit with a cryptolocker and you have no backup you simply lose that data. Or you can pay the ransom, get your data back and go to jail.
While this might seem unfair, it might stop 1000 other attacks because there will be no money in it. It would be for the greater good.
- pfisch 7y agoWhat happens when a hospital gets hacked? This law could kill people.
- slg 7y agoWhy don't we make getting mugged illegal while we are prosecuting victims. If you give your wallet to a mugger, you go to jail. Then no one mugs anyone anymore, right? /s People pay ransoms because they want back whatever is being ransomed. Making it illegal to pay the ransom isn't going to stop that. It will just push everything underground and make it harder to catch the ransomers.
- arcticbull 7y agoMugging involves threat of physical harm. Getting ransomeware'd doesn't, and if cities stopped paying then this kind of attack would stop. It's more like outlawing giving muggers your wallet when you're dressed like Iron Man.
- dmix 7y agoWhat happens if the ransomwares don't stop? Do you spend a bunch of money on investigations to see if some thousands of small towns or little agency somewhere kept if quiet because the cost otherwise is huge? Up the fines the tax payers will pay when they get caught?
- olliej 7y agoI don’t like this argument: if the ransomware takes out emergency dispatch, hospital systems, etc it gets much closer to what you’re claiming.
- vidarh 7y agoThat's assuming attacks that are specifically targeted instead of a scatter approach. If the latter, then it will only stop when the perceived potential for payout worldwide drops low enough.
- tyree731 7y agoI'm not sure why the distinction between physical and virtual harm is relevant. Physical harm is valuable for a person to stop because their life has value to them, and virtual harm is valuable for an organization or person to stop because the virtual assets being harmed have value to the organization or person. We could get into the monetary value of a life and whether a sufficient amount of virtual harm, especially when that virtual harm might reasonably translate into a life (emergency systems, insurance payouts, etc.), but I don't think we even need to.
- istjohn 7y agoThe difference is the mugger gets your wallet one way or the other. The only difference is if you survive to tell the story. The ransomware attacker is only rewarded if the victim capitulates. Edit: On the other hand, if the counter-factual was a mugger at an ATM demanding you enter your PIN, that distinction doesn't exist. So maybe you're right. Maybe the right answer is to outlaw paying the ransom except to save human life, but also create a federal fund to compensate victims of these attacks.
- sneak 7y agoMunicipalities that don’t have backups aren’t the victims. Taxpayers are, and if they stop paying ransoms, they won’t be victimized any further.
- manfredo 7y agoBecause getting mugged isn't a choice that somebody makes. A closer analogue is criminalizing paying kidnapping ransoms. Which is a crime in several developed countries, so as to disincentivize kidnappers.
- asdfasgasdgasdg 7y agoTechnically it is illegal in the US, at least if the kidnapping organization is labelled as a terrorist group. However, as far as I can tell, no one has ever been prosecuted under this law.
- astral303 7y agoIf you think that getting hacked is a choice that somebody makes, you have your perspective way out of whack. Computers are hard.
- pasquinelli 7y agoNo, paying the ransom is the choice.
- manfredo 7y agoI don't think my point way conveyed correctly to you. Getting hacked is not a choice and should not be criminalized. Paying ransomes to hackers is a choice and there are good reasons to prohibit that to disincentivize hacking.
- dmoy 7y agoGiving a wallet over while being mugged is the analogy to paying the ransom here. Having the knife brandished in your face is the analogy to the hack. Not saying I agree with it either way, just pointing out that y'all appear to be talking past each other.
- seer 7y agoIts not really a good analogy. If you get mugged you are coerced to give your wallet, on pain of _much_ greater punishment, usually the greatest there is - death. If your company’s data is cryptolocked, you are coerced to give money on pain of getting that data lost. The difference is that the punishment for non compliance is much different. If you made paying a ransom in this case illegal you would actually promote better backup/restore/security practices, at the cost of sometimes loosing data. If it was vital for that data not to be lost then not having adequate backups is a _much more_ serious problem as that data could be lost for different reasons. And you’re funding organized crime which has very bad downstream effects. If you had to make a more adequate analogy, imagine someone stealing your personal documents then demanding money to get them returned - you should have a strategy to restore those in other events like fires and stuff, so you might pay money, or not. But if you do you encourage future theft like that for you and others, and that money might be used for some other, usually nefarious stuff.
- praxulus 7y agoYou might be right for private individuals, but it's much harder for a business, let alone a municipal government, to pay a ransom under the table and get away with it.
- dvdbloc 7y agoOr easier, because the government can get away with a lot. Either way is speculation
- zelon88 7y agoI think a viable alternative would be to flow the cost down to the elected or appointed officials in charge who created such an environment. The town should have bylaws to force resignation and emergency elections in the event that this happens. Then the town should have legal precedent to bring the administration to civil court for damages. The town administration, personally, should be collectively on the hook to the town the cost of the ransom. It really does amount to a dereliction of duty.
- cookie_monsta 7y agoIt's not being the victim of a crime that would be illegal, it's the response to it. If you are attacked by an unarmed person and you shoot them while defending yourself it's fairly common for that case to go to trial to test whether the homicide was justified. Presumably people have gone to prison under just those circumstances. You could quite easily frame a law around justified ransom-paying, how fair it would be is unknowable.
- ianferrel 7y agoIt seems like a terrible misuse of state power to further punish people who were the victim of a crime. Also notice that this won't necessary ransom payments. It will raise the cost to: 1. The victim who pays with jail time. 2. Society who spends time investigating and jailing victims. Notice that ransomware authors are not on that list.
- quickthrower2 7y agoI was assuming they are already commuting a crime.
- Choco31415 7y agoIt’s not black/white as having backups solves ransomware attacks. All that the ransomware must do is lay low long enough that the oldest backup is likely to have occurred after the infection, hence containing it.
- eloff 7y agoFor whole system backups only. If you just backup the data then it doesn't matter if the ransomware is there as data - data can't execute without some actor who runs it, be that the system or a person.
- EvanAnderson 7y agoRunning "low and slow" isn't a tremendously good strategy for ransomware. Slowly encrypting data over time is more likely to get caught and stopped, versus "shock and awe". I'm waiting until ransomware starts leveraging the encryption functionality in common backup systems. Not many sysadmins would notice if their backup encryption keys were changed-out for 6 months and deleted at the same time that the "encrypt all the data" event happened. (The only Customers I've ever worked with who were already doing air-gapped backup verification were regulated businesses in the financial sector.)
- chongli 7y agoYeah, I was going to say: the last company I worked for sent their backups off-site on a nightly basis. They were also often requesting old tapes to be pulled in for the next night's delivery/pickup so that they could test against old data. It would be pretty hard to get your ransomware to encrypt all those offsite backups sitting in a vault somewhere.
- munk-a 7y agoI wonder if it might be worth it for the compromise to lie dormant for a while though - if the compromise was injected nine months ago and a ticking clock was started then full image backups will essentially be useless - as soon as the image is restored then the attack will re-trigger. This probably lowers the domain that can be effected because many potential targets won't have vectors that could be compromised in a compatible manner.
- sporkologist 7y ago> simply lose that data Maybe the worst use of "simply" ever.
- JumpCrisscross 7y ago> It would be for the greater good I'm not so sure. We're nearing an interesting equilibrium where insurance companies pay ransoms, thereby taking an interest in the security of their pool, while attackers probe for vulnerabilities. Put another way, we have a pen testing group being paid by a digital security group. If the net result is better security in exchange for the insurance "tax," that could be a modest improvement.
- ineedasername 7y agoIs there any evidence the insurers are actually driving increased security? Do their policies require certain security standards or backup processes? If they do, it's not a bad start.
- robocat 7y agoMatt Levine wrote a little on the perverse incentives of insurers in this case: "This creates weird incentives. [Insurers] want the risk to be big and dangerous and salient. [Insurers] want everyone to worry about it all the time, so they [get] lots of money for premiums. Then ideally [insurers] help clients avoid the risk, so that [Insurers] can keep more of the premiums, but basically it is a volume business and [insurers would] rather collect more premiums and pay more claims than have fewer of each." Scroll down about 2/3rd to the "Insurance" heading for his complete comments: https://www.bloomberg.com/opinion/articles/2019-08-27/the-libor-change-is-coming#insurance https://www.bloomberg.com/opinion/articles/2019-08-27/the-li...
- gojomo 7y agoIf you really want to game-theory this out... Why not enact into law a limited immunity for any such ransomware that (a) only charges a modest amount for decryption; (b) never exfiltrates private data to elsewhere; (c) after payment, reveals all security lapses that allowed penetration? From a certain perspective, ransomware identifies & forces correction upon institutions that have been careless with their security or backups. Truly nasty attackers could do even worse: stealing & reselling data, or leaving silent long-term compromises in place to bleed targets more extensively. So, carving out an safe harbor for "uncontracted vulnerability discovery & remediation" via the payment of modest ransoms could be a socially-efficient policy, aligning incentives of many participants: targets, the customers of targets, and grayware authors. Perhaps, the whole process could be automated even without explicit support from lawmakers: leave an appropriate crypto balance, on the systems at risk, in a conventional place. It'd mean: "If you can see this, we know we've screwed up – but we're OK with you taking this amount, and no more, if you close the hole behind you & leave us a note of what we did wrong." Viewing the movement of that bounty on a blockchain would be a public disclosure of the compromise, and gray-hat actors that confined their activity to the collection of such bounties wouldn't need to fear criminal prosecution. (Hmm, maybe we should just put private-keys controlling small bitcoin-balances into any free-form fiels of our records with typically-careless institutions – so we can independently sense when our private data has been accessed by dishonest actors – whether institution insiders or hackers.)
- Johnny555 7y agoWhy not enact into law a limited immunity for any such ransomware that (a) only charges a modest amount for decryption; (b) never exfiltrates private data to elsewhere; (c) after payment, reveals all security lapses that allowed penetration? We can't even hold commercial software developers to enforce secure coding standards, yet we're expected to trust anonymous malware writers to write code that is proven to not exfiltrate data and trust that they are ethical enough to reveal all of the weaknesses they found?
- gojomo 7y agoYou can still capture the malware in honeypots & analyze its behavior – and try all the investigation and enforcement methods currently used. But, those grayhats seeking to use this safe-harbor would be more open about their identities & methods. They can even deposit their earnings into KYC'd bank accounts! So imagine some bad-faith actor pretends to be complying, but then turns out not to be & tries to double-dip – taking both the conditional bounty, and more. Such people will now be competing with other hackers who are playing by the rules – leaving the nastier actors fewer open systems. And anyone who seems to obfuscate their identity/methods will stick out as a likely bad-faith actor. Thus I'd expect they'd be a lot easier to catch, and have more to lose, than in the status quo.
- ineedasername 7y agoI think it might better to make the insurance illegal. That way the money or losing the data really stings. You can't just pay a premium and ignore actually having good security and reasonable backup systems.
- munk-a 7y agoBanning insurance in a market that naturally denies it just opens people up to be more arbitrarily singled out by the fickleness of fate. Making payments illegal and requiring people who are vulnerable to ransomware (i.e. everyone) to pay to be audited for good security practices on a regular basis is a more reasonable approach to eliminate the threat - do that for thirty years or so and the best practices for combating ransomware will become common knowledge and standard practice.
- munk-a 7y agoIt would require responsible enforcement - how many people who have had their bike stolen have gotten a non-committal response from the cops and then found and tried to recover their bike after some trivial googling and searches on craigslist? If the policy were responsive and funded to the point where individuals outperforming them by putting in some effort was a rare thing then it might be reasonable to impose a fine for giving in (as it encourages more crime). Right now ransomware is thriving on the fact that LEOs are too disorganized, underfunded and unmotivated (since this is way outside the domain knowledge of their personnel) but if some serious efforts were made to provide secure recovery snapshots as a public service then maybe we could look at taking this route. As it is right now ransomware attacks are incredibly common and usually conceded to, you'd be fining pretty much everyone.
- zelly 7y ago"I recorded all our conversations and your Bitcoin transaction tied to your Coinbase.com identity." Now the attacker can extort twice.
- morpheuskafka 7y agoI was surprised to hear there is not already a law/policy against taxpayer money being used to pay known criminals. How is this different that the city paying off the mafia for protection?
- OrgNet 7y agomaybe we should just put the FBI in jail whenever they don't catch them in the act
- SapporoChris 7y agoI read in a scifi book, I think Larry Niven short story... The wealthy elite signed contracts to the effect that regardless of the demands of kidnappers, no ransoms would be paid by families or estates. Once news of the contracts became public knowledge the rate of kidnappings plummeted. Of course, at the start a few hostages were sent back to families piece by piece. But word did get around after that. So instead of straight out crime, contracts if implemented globally, nationally or even statewide, might be a solution. I'm probably overlooking something :)
- chillacy 7y agoProbably that in real life the US position of "we don't negotiate with terrorists" might not be helping: > But the data just doesn't support it. Kidnapping is really a crime of opportunity. And there is no evidence or very little evidence to suggest that kidnappers are checking passports, and your nationality is going to determine whether you're kidnapped or not, regardless of the particular policy that your government has. https://www.pbs.org/newshour/show/why-u-s-policy-toward-negotiating-with-terrorists-may-be-risking-americans-lives https://www.pbs.org/newshour/show/why-u-s-policy-toward-nego...
- AnIdiotOnTheNet 7y agoI'd be very surprised if such a thing would work outside of fiction. Nobody feels more entitled to break the rules than the wealthy elite, and very few people in the situation of having a loved one held hostage are going to stand on principle. As soon as one has paid, the bluff has been called.
- freeflight 7y ago> While this might seem unfair, it might stop 1000 other attacks because there will be no money in it. It would be for the greater good. It wouldn't stop any attacks because the ransomers are already willing to break the law, the only thing that would change is that you'd end up punishing a few victims that get caught paying. Probably after reporting the crime in the first place, which means victims will be less likely to report it. That hardly sounds like a sensible solution, or any solution at all because it wouldn't affect the actual criminals at all.
- landryraccoon 7y agoAll that will happen is that victims will be afraid to go to the police, and hackers will be even more emboldened.
- invalidusernam3 7y agoWhich country are you suggesting implements this? Every country on earth?