8 ms·

Why don't we make getting mugged illegal while we are prosecuting victims. If you give your wallet to a mugger, you go to jail. Then no one mugs anyone anymor

• arcticbull 7y ago
  Mugging involves threat of physical harm. Getting ransomeware'd doesn't, and if cities stopped paying then this kind of attack would stop. It's more like outlawing giving muggers your wallet when you're dressed like Iron Man.
  • dmix 7y ago
    What happens if the ransomwares don't stop? Do you spend a bunch of money on investigations to see if some thousands of small towns or little agency somewhere kept if quiet because the cost otherwise is huge? Up the fines the tax payers will pay when they get caught?
  • olliej 7y ago
    I don’t like this argument: if the ransomware takes out emergency dispatch, hospital systems, etc it gets much closer to what you’re claiming.
  • vidarh 7y ago
    That's assuming attacks that are specifically targeted instead of a scatter approach. If the latter, then it will only stop when the perceived potential for payout worldwide drops low enough.
  • tyree731 7y ago
    I'm not sure why the distinction between physical and virtual harm is relevant. Physical harm is valuable for a person to stop because their life has value to them, and virtual harm is valuable for an organization or person to stop because the virtual assets being harmed have value to the organization or person. We could get into the monetary value of a life and whether a sufficient amount of virtual harm, especially when that virtual harm might reasonably translate into a life (emergency systems, insurance payouts, etc.), but I don't think we even need to.
    • istjohn 7y ago
      The difference is the mugger gets your wallet one way or the other. The only difference is if you survive to tell the story. The ransomware attacker is only rewarded if the victim capitulates. Edit: On the other hand, if the counter-factual was a mugger at an ATM demanding you enter your PIN, that distinction doesn't exist. So maybe you're right. Maybe the right answer is to outlaw paying the ransom except to save human life, but also create a federal fund to compensate victims of these attacks.
• sneak 7y ago
  Municipalities that don’t have backups aren’t the victims. Taxpayers are, and if they stop paying ransoms, they won’t be victimized any further.
• manfredo 7y ago
  Because getting mugged isn't a choice that somebody makes. A closer analogue is criminalizing paying kidnapping ransoms. Which is a crime in several developed countries, so as to disincentivize kidnappers.
  • asdfasgasdgasdg 7y ago
    Technically it is illegal in the US, at least if the kidnapping organization is labelled as a terrorist group. However, as far as I can tell, no one has ever been prosecuted under this law.
  • astral303 7y ago
    If you think that getting hacked is a choice that somebody makes, you have your perspective way out of whack. Computers are hard.
    • pasquinelli 7y ago
      No, paying the ransom is the choice.
    • manfredo 7y ago
      I don't think my point way conveyed correctly to you. Getting hacked is not a choice and should not be criminalized. Paying ransomes to hackers is a choice and there are good reasons to prohibit that to disincentivize hacking.
      • dmoy 7y ago
        Giving a wallet over while being mugged is the analogy to paying the ransom here. Having the knife brandished in your face is the analogy to the hack. Not saying I agree with it either way, just pointing out that y'all appear to be talking past each other.
        • seer 7y ago
          Its not really a good analogy. If you get mugged you are coerced to give your wallet, on pain of _much_ greater punishment, usually the greatest there is - death. If your company’s data is cryptolocked, you are coerced to give money on pain of getting that data lost. The difference is that the punishment for non compliance is much different. If you made paying a ransom in this case illegal you would actually promote better backup/restore/security practices, at the cost of sometimes loosing data. If it was vital for that data not to be lost then not having adequate backups is a _much more_ serious problem as that data could be lost for different reasons. And you’re funding organized crime which has very bad downstream effects. If you had to make a more adequate analogy, imagine someone stealing your personal documents then demanding money to get them returned - you should have a strategy to restore those in other events like fires and stuff, so you might pay money, or not. But if you do you encourage future theft like that for you and others, and that money might be used for some other, usually nefarious stuff.
• praxulus 7y ago
  You might be right for private individuals, but it's much harder for a business, let alone a municipal government, to pay a ransom under the table and get away with it.
  • dvdbloc 7y ago
    Or easier, because the government can get away with a lot. Either way is speculation
• zelon88 7y ago
  I think a viable alternative would be to flow the cost down to the elected or appointed officials in charge who created such an environment. The town should have bylaws to force resignation and emergency elections in the event that this happens. Then the town should have legal precedent to bring the administration to civil court for damages. The town administration, personally, should be collectively on the hook to the town the cost of the ransom. It really does amount to a dereliction of duty.
• cookie_monsta 7y ago
  It's not being the victim of a crime that would be illegal, it's the response to it. If you are attacked by an unarmed person and you shoot them while defending yourself it's fairly common for that case to go to trial to test whether the homicide was justified. Presumably people have gone to prison under just those circumstances. You could quite easily frame a law around justified ransom-paying, how fair it would be is unknowable.