5 ms·

We need to make it illegal to pay ransoms. Paying a ransom is like defecting in a prisoner's dilemma: it benefits you at the expense of hurting everyone else w

• Wowfunhappy 7y ago
  I've been thinking the same thing, lately. When Randsomware was a new idea and seemed to be primarily targeting individuals, it made sense that paying your way out should ultimately be legal. Any law against it would be difficult to enforce, so bad actors would still be incentivized to launch attacks, and only law abiding citizens would be hurt. But now they're attacking banks, and hospitals, and cities. I have trouble imagining large hospital systems would be able to discretely pay hundreds of thousands of dollars illegally without anyone noticing—and if they did, it would be easy to prosecute. Ergo, outlawing these payments should very significantly reduce the number of ransomware attacks against these large targets. If no one can pay, there's no incentive to attack.
• dmix 7y ago
  This story provides a good counterpoint. What if doing so saves lives at a hospital who needs to get back online ASAP? A "saves lives" loophole? Not to mention every law should first be measured on whether it is at all practical to meaningfully enforce. I guarantee there has been 100x more companies who've paid the ransom and didn't release a press release like this one did. If a whole bunch of people are going to do it anyway quietly and the law isn't going to stop them, we're just going to occasionally double up the fines on the random businesses that get caught. While these endless ransomware hackings continue. I'd much rather we spent public resources on prevention.
  • Wowfunhappy 7y ago
    You're saving lives now but endangering future lives. If no one paid the ransom, ransomware wouldn't exist. the more people who pay the ransom, the more incentive attackers have to create ransomware.
    • jonny_eh 7y ago
      > If no one paid the ransom, ransomware wouldn't exist Even if we made it illegal, it doesn't mean people wouldn't pay them.
    • jonny_eh 7y ago
      > If no one paid the ransom, ransomware wouldn't exist Even if we made it illegal, it doesn't mean people wouldn't pay them. It would just punish victims further.
      • ironmagma 7y ago
        Put another way, which would you rather do, indirectly kill people or break the law? This is the decision a hospital administrator would be faced with. I suspect that most people would see fit to disobey the law in this situation. It could easily be argued to be a legitimate case of civil disobedience.
        • wcip 7y ago
          I work in this space. Its probably not a matter of kill people, doctors in ER's don't really need a EHR to function and sometimes do without due to technical issues. The issue is that the hospital won't be able to bill without documentation.
    • dmix 7y ago
      > If no one paid the ransom, ransomware wouldn't exist I guess you didn't read the second half of my comment where I suggest that will likely be idealistic and unreleastic. Enough companies will still pay quietly to keep it going. I'd be shocked if they didn't.
      • Wowfunhappy 7y ago
        If an individual is attacked, sure. If you're attacking a public institution like a hospital and demanding many thousands of dollars... it's pretty hard to hide a payment like that. So if you outlawed paying such ransoms, those types of ransoms would stop. Individuals would still be attacked and asked to pay a few hundred dollars, but such instances rarely put lives at stake.
  • ikeboy 7y ago
    Set a threshold where payments above that amount are illegal. Even a threshold at say, 25k or above will reduce the incentive to attack individual systems, and payments of that size are difficult to hide if everyone knows they're illegal.
  • daveFNbuck 7y ago
    The idea behind not paying is that it makes ransomware unprofitable and people stop doing it. A loophole for saving lives would cause ransomware distributers to target their attacks in ways that endanger lives.
  • KingMachiavelli 7y ago
    It wouldn't need to work that way. If a law was past mandating that in 5 years paying ransoms would be illegal then companies would be forced to either invest or be held liable after that grace period. Of course there could be an exception process that involves contacting LE first, paying the ransom, being fined and audited, and having to disclose a report online and in front of the entrances of the when, why, and how this occurred. Paying the ransom w/o going through this process could (maybe?) be treated as conspiring with the attacker (& since the identities of the attackers are almost always 100% unknown, some could legitimately have inside contacts anyway).
  • scintill76 7y ago
    What if the malware changes a medical record (maliciously or accidentally), and the discrepancy leads to a lost life? Seems strange to hang lives on the word of criminals, if lives are really at stake.
  • gruez 7y ago
    >Not to mention every law should first be measured on whether it is at all practical to meaningfully enforce. I guarantee there has been 100x more companies who've paid the ransom and didn't release a press release like this one did. Let's say you're the in C-suite of a hospital that's held for $1M ransom, and you want to pay. How are you going to send the funds without someone in finance/accounting finding out? Maybe you try to convince them to keep quiet? Such a transaction will almost surely generate a suspicious activity report from the bank. Are you going to try structuring the transaction? How are you going to hide that $1M defect in your quarterly/annual reports? Are you just going to hope it doesn't get noticed by the IRS or the accountants auditing your report? The whole thing is going to unravel because of how many people you need to be "in" on the criminal conspiracy, and the amount of noise it generates. If you're caught, the amount of papertrail you left behind (from literally every step of paying the ransom) would make it very easy to prosecute. You could try laundering your activities to a third party firm that does "ransomware recovery" (ie. they take your money and pay the ransom for you), but I'd imagine that if paying ransoms were illegal, the activities of those companies would be closely scrutinized.
• chelmzy 7y ago
  I 100% disagree. Sometimes it is the only way to get things back running. I understand its the organization's fault for not having backups. It would destroy some businesses, hospitals, schools if they weren't able to pay the ransom.
  • ikeboy 7y ago
    > Sometimes it is the only way to get things back running. I understand its the organization's fault for not having backups. It would destroy some businesses, hospitals, schools if they weren't able to pay the ransom. That doesn't change the game theory dynamics that I pointed out above.
    • staticautomatic 7y ago
      I bet you'd be singing a different tune if the life of someone you loved was at stake.
      • ikeboy 7y ago
        If someone I loved was in a hospital that might get targeted by ransomware, I'd prefer we adopt the policies that reduce the prevalence of ransomware.
        • gjs278 7y ago
          ok but now your mom is dead
        • ironmagma 7y ago
          This is assuming you can time travel. In reality, you have no idea what hospital your loved ones will end up at, nor whether they will (chances are they will not), nor what systems to protect in advance. On top of that, you would have to convince others that the investment is worth making.
      • leetcrew 7y ago
        sure, most people would. but the things a private individual would be willing to do under extreme leverage don't make a good basis for policy.
• tyingq 7y ago
  There's also no guarantee that paying gets you your data back. Either because the random holders don't care, or because a white hat killed off some part of the ransom holder's communication channel.
  • panarky 7y ago
    Or because the malware author borked the decryptor. https://www.bleepingcomputer.com/news/security/ryuk-ransomware-decryptor-is-broken-could-lead-to-data-loss/ https://www.bleepingcomputer.com/news/security/ryuk-ransomwa...
• mbesto 7y ago
  > Making it illegal just forces everyone to cooperate and is something everyone would prefer. Doesn't making it illegal just change the cost structure? The penalty for illegally paying a ransom in your proposed system would be simply to pay a fine. It's effectively how a rich person might look at a parking ticket for a premium parking spot - it might be cheaper for them to simply pick the illegal spot than to have to drive 2 miles away and call an uber to get to their destination.
  • ikeboy 7y ago
    I'd make it a crime punishable by prison in proportion to the amount paid, or perhaps require a multiple of the amount paid as a fine. If you need to pay 10X the ransom as a fine, then the ransom criminals can extract goes down by a factor of 10.
    • mcny 7y ago
      I’d be ok with it only if the ceo and the board are the ones going to prison and there’s a minimum mandatory sentence of (at least) one year with no possibility of parole or commutation or anything like that.
      • ikeboy 7y ago
        That just sounds punitive. The goal here is to deter ransoms and ultimately reduce the incentive for ransomware, not to be punitive.
      • mbesto 7y ago
        To what avail? CEOs regularly make much worse decisions that create much more grave externalities (example - oil spills). There's much bigger fish to fry than for-profit hospital systems.... No offense, but this proposal is essentially DOA.
        • austhrow743 7y ago
          Creating oil spills isn't illegal and can't be if you want to get oil. Different scenarios. As for size of fish, we don't go "why is theft illegal when there are murderers still roaming around?" We can have both be illegal.
• lonelappde 7y ago
  Sure, let use the DEA to enforce that law since they are already experts at persecuting victims. How about instead the government proactively pentests and fines orgs for security violations,and uses the money to finance education, training, and security development?