6 ms·

Because you shouldn't criminalize being a victim. I agree that it's probably a bad idea to pay a ransom, since that just supports the success rate and makes ra

• paulryanrogers 7y ago
  For private individuals perhaps it shouldn't be criminal. But for businesses responsible for other people's private information? Yes, I think there is professional negligence if they cannot even restore backups in a timely manner. (Or cannot detect infections before they become so widespread the whole thing falls down.)
  • logicallee 7y ago
    The part I would criminalize is the money-wiring part.
  • parsimo2010 7y ago
    The action that a business should be punished for is not keeping their customer's information secure. Paying a ransom to recover after they are the victim of a crime should not be what they are punished for. If they were doing everything right but still got hit by ransomware I don't think they should be punished. If you can prove that they wrote their login info on a sticky note and left it in the main lobby then you should punish the bad security practice if it exposes other people's information. Several parts of the world have kidnapping and piracy issues, and you can buy kidnapping/piracy insurance to pay ransoms in case you are the victim of such a crime. I think most people in the world acknowledge that sometimes bad things happen even when you take reasonable precautions, and you shouldn't be punished just because you were the unlucky one. Most security experts agree that no computer system is un-crackable, there are just varying levels of sophistication and access needed to do so. We've even seen that Stuxnet was capable of jumping air gaps. If a business had such good security that their database and backups were air-gapped but still was hit by ransomware do you think that they should still be fined?
    • tempguy9999 7y ago
      > If they were doing everything right but still got hit by ransomware Then I'd say there weren't doing things right. Granted there should be exceptions for when they really did do their best, but generally no. > Most security experts agree that no computer system is un-crackable It doesn't have to be, merely needs being not worth the effort to the criminals.
      • Broken_Hippo 7y ago
        Sure, Maybe they could do more. Could they have done more with the resources they had? Would taxpayers/stockholders fund it? Would a small business have the cash flow to do better? If they were told it was secure from the tech folks, would the non-tech folks have any way to prove this wrong? It is really easy to say after something happens that they weren't doing things right. It isn't always so easy before things happen to know if things are done correctly, though. And trying to figure out what isn't worth it to the criminals is rather difficult. Some folks do quite a bit for an otherwise small amount of money, especially if they feel the victim "deserves" it.
        • tempguy9999 7y ago
          > Would taxpayers/stockholders fund it? And who pays the ransomware when it happens, if not the taxpayers/stockholders? Or does money just get created out of nothing when needed? > Would a small business have the cash flow to do better? IME small businesses can do it if they want to. It takes care, meaning policies, it's not expensive. Also small businesses are less attractive to large criminals. > If they were told it was secure from the tech folks, would the non-tech folks have any way to prove this wrong? If they got publicly ransomed, it would become very obvious something needed looking at. The process of potentially hammering them legally would involve them being taken to court where their level of culpability would be decided (and it may be they did do enough so get let off, and everyone can see what happened, and other businesses can decide perhaps to up their security based on the results). These are all strawmen. I'm not asking for uncrackability, merely due diligence. A little of that goes a long way. These arguments don't stand up. You seem to be arguing for... what?
• logicallee 7y ago
  Do you think Americans should be free to wire money to ISIS if it's a "ransom" - something as little as unlocking some digital photos?
  • landryraccoon 7y ago
    The wording “free to” implies that the victim feels like they’re doing something voluntary rather than coerced. Think of it this way - let’s suppose you make it a crime to give your wallet to a mugger with a gun. Is that going to end up with less crime, or just more people shot, and some innocent victims going to jail just because they didn’t want to get shot?
    • bryanrasmussen 7y ago
      it is however a crime to give money to terrorist organizations. So the wording "free to" really means do you think it should be legal to do so.
      • SmellyGeekBoy 7y ago
        But how are we supposed to tell whether a given bitcoin wallet is controlled by terrorists?
    • xorcist 7y ago
      You seem to presume all of these cases are involuntary. This seems like an excellent way to siphon public funds. Get infected by "malware", pay "ransom". Voilà, public funds are now some cryptocurrency under your control. It would surprise me if this has never happened.
      • icebraining 7y ago
        Replacing regular corruption, which is often "unethical but legal" or "barely punished", with a federal crime that is known to be harshly prosecuted doesn't seem like a great idea to me.
      • 7y ago
• mattigames 7y ago
  I can cherry-pick counter-examples too, imagine Bill Gates or other billionaire paying a a billion dollar ramsom to Isis, but letting them walk away for free because he is "just a victim". A law against paying ramsoms should exist, maybe it should have exceptions for small amounts or something, but letting them legal by default it's way more problematic.
  • parsimo2010 7y ago
    My examples weren't cherry picked, they were the most common type of occurrence and also the one directly related to the post. But to attack your admittedly cherry picked example, I guarantee that the US government wouldn't fault Bill Gates, they would help him out and track the money that he transferred and turn it against the terrorists.
    • mattigames 7y ago
      Sure, I would like to see the government tracking back the bitcoins and transferring them back. By the way, another other dark side of making paying ransoms legal is that transferring money to a terrorist group (just because they support it) now has a plausible deniability: "Don't blame me! It was just a ransom!"
      • parsimo2010 7y ago
        Let's clear one thing up: Fraud is still illegal, and I have never suggested that we legalize fraud. If you're using "ransomware" as a pretext to fund terrorism then you should go to jail- but a prosecutor should be able to prove your guilt. If, however, you pay a ransom because you are a legitimate victim then that should not be a crime. Most these "what ifs" get close to solutions in search of problems. Instead of ensnaring innocent people in the hopes of catching people who intentionally commit fraud and fund terrorism, let's use the laws we already have on the books to do so. Edit to address the bitcoin issue: While a bitcoin transaction is hard to reverse, knowing the wallet addresses of terrorists and being able to track their bitcoin transactions would be a huge win for the good guys. And when that bitcoin inevitably gets turned into useful currency it will be another opportunity to track them. I don't think ISIS would move a billion dollars through bitcoin anyway, they'd probably pick a different method. That kind of transaction would be super hard to deal with and the network would get stressed to the point that trying to sell a billion dollars worth of bitcoin would ensure that it would be worth a lot less than a billion dollars.
• SOLAR_FIELDS 7y ago
  I used to work for a city and had the demand been something reasonable to the size of the city (tens of thousands of dollars) they may have just paid it. The city I worked for had pretty good backups in place but still might have even done it to not lose a few days worth of work. FWIW the city I worked for was a suburban city with a population of about 80k
  • VectorLock 7y ago
    The city was ready to pay $400k. Or their insurance was, at least. Insurance was looking at it from the coldest perspective possible-- how much would it cost us to fix this otherwise?
    • msmerberry 7y ago
      Yup that's what I came here to say. It might have been easier to take a higher insurance premium and let it pay the ransom than to do a restore exercise. Either way, bravo.
      • VectorLock 7y ago
        There is of course the terrible secondary effect of encouraging more ransomware but the insurance companies can simply sidestep this by saying "we don't cover that."
• Lucadg 7y ago
  In the 80s there was a wave of kidnappings in Italy. A new law made it so that relatives bank accounts were frozen immediately and they where forbidden to pay. I don't remember the details but it was a wildly successful move.
  • moring 7y ago
    This is different, though. Freezing their bank accounts makes it impossible to pay and thus gives the victim a plausible excuse not to pay.
    • IshKebab 7y ago
      Right, in the same way that making it illegal for cities to pay would. Probably wouldn't stop normal people paying but they don't have $400k of data to steal. So I'd say it's exactly the same.
      • afiori 7y ago
        It is not the same as the city essentially is put in the situation were they need to choose between losing data and paying both a ransom and a fine (unless you want a federal agency to freeze ALL city controlled funds). If you want to stop city from paying the the law need to state that even if they get their data back they need to delete it.
  • ordu 7y ago
    Why relatives of a victim didn't stopped informing police about the kidnaping? If government didn't know, then bank accounts wouldn't be blocked. Now a victim has a reason to not inform government, and now it is possible to kidnappings to continue without any government record, and we may come to a situation when it is all nice on the paper, while it becomes even worse than was before law-maker's intervention. Was those bank accounts blocks where a successful move, or kidnappings stopped due to other measures government made?
    • Lucadg 7y ago
• beagle3 7y ago
  You shouldn’t criminalize victimhood, but for a municipality to have no backups should be considered criminal negligence - and if you do have proper backups, the cost of restoring them should be a small fraction of the ransom — so in such a setting, paying ransom should involve a criminal indictment even though it shouldn’t be about the payment. This city had proper backups, and indeed was able to avoid paying ransom. Others weren’t so competent. Unfortunately, these networks will continue to be insecure and that’s a real problem - right now everyone is pretending that it’s “lose your data or pay” for which backups are useful. However, if a hacker gains foothold into a network, and then, for 3 months, randomly changes record (say, randomly exchanging penalties owed among 1000 people every day through the day), then it’s unlikely backups will help - you’d have a mix of new and corrupt data in every backup set even if you have a daily one going back a whole year (and most places are lucky to have more than a week at daily)
  • otakucode 7y ago
    Criminal negligence requires violation of established standards. Not just 'common industry practice' or even 'basically sensible', but legally established standards bodies who have laid out what practices and requirements must be fulfilled. Computer and software systems lack these standards completely. There is nothing. As such, if a computer is involved, it is impossible to prosecute criminal negligence. This is a big issue that will only become more pressing, but there are strong arguments on both sides of the argument over whether such standards should be established or not. Computer people don't want to raise the barrier to entry by requiring licensing and following regulations, and money people don't want to pay for licensed computer/software engineers. Not to mention just deciding what the standards should BE and how the standards body should be constituted and run is guaranteed to be a rats nest and a sequence of progress-thwarting horrors... but the cost of not tackling it and paying for it will cost lives. We can be guaranteed that.