6 ms·

I'd make it a crime punishable by prison in proportion to the amount paid, or perhaps require a multiple of the amount paid as a fine. If you need to pay 10X th

by ikeboy 7y ago

I'd make it a crime punishable by prison in proportion to the amount paid, or perhaps require a multiple of the amount paid as a fine. If you need to pay 10X the ransom as a fine, then the ransom criminals can extract goes down by a factor of 10.

mcny 7y ago
I’d be ok with it only if the ceo and the board are the ones going to prison and there’s a minimum mandatory sentence of (at least) one year with no possibility of parole or commutation or anything like that.
- ikeboy 7y ago
  That just sounds punitive. The goal here is to deter ransoms and ultimately reduce the incentive for ransomware, not to be punitive.
- mbesto 7y ago
  To what avail? CEOs regularly make much worse decisions that create much more grave externalities (example - oil spills). There's much bigger fish to fry than for-profit hospital systems.... No offense, but this proposal is essentially DOA.
  - austhrow743 7y ago
    Creating oil spills isn't illegal and can't be if you want to get oil. Different scenarios. As for size of fish, we don't go "why is theft illegal when there are murderers still roaming around?" We can have both be illegal.
    - mbesto 7y ago
      My point is that we very rarely give criminal sentences to corporate executives in the US. This seems like an odd one to start with.
mbesto 7y ago
But doesn't eliminate hackers who do this type of stuff for the "lulz" (and if anything, makes it worse and potential a weapon for people who want to promote larger government). I understand the general premise of the proposal, but it's not a fool-proof check on game theory.
- ikeboy 7y ago
  It doesn't completely solve the problem, no. But the stories of hospitals and other entities paying non-trivial sums in ransom I would expect are mostly professional criminals, not hackers doing it for lulz.
jb775 7y ago
For conversation's sake, what if the victim is a small/mid-size business where the entire business would be destroyed in the event their systems are not unlocked immediately? Do they choose between possible prison time or definite loss of everything? Enforcing a fine relative to the ransom paid (and maybe relative to the "if we wouldn't have paid it" severity) is probably a good immediate start. This would at least galvanize businesses to improve existing security.
- austhrow743 7y ago
  Small businesses would have been destroyed by all sorts of rules that have already been passed. Companies whose entire service was dumping asbestos in to lakes or companies who only managed to turn a profit by hiring child labour. Their owners had to choose between possible jail time or losing everything. Every single thing done by a government, or really just any large player in the market place, is going to have small businesses that get flattened by it. That your entire company could be wiped out by changes in the marketplace, including laws, is one of the risks a person assumes when they decide to start a small business instead of working as an employee. They're earning their slice of the money pie in part by assuming that risk.
A_Parr 7y ago
Can you prove you didn't pay?

by ikeboy 7y ago

mcny 7y ago

I’d be ok with it only if the ceo and the board are the ones going to prison and there’s a minimum mandatory sentence of (at least) one year with no possibility of parole or commutation or anything like that.

ikeboy 7y ago
That just sounds punitive. The goal here is to deter ransoms and ultimately reduce the incentive for ransomware, not to be punitive.
mbesto 7y ago
To what avail? CEOs regularly make much worse decisions that create much more grave externalities (example - oil spills). There's much bigger fish to fry than for-profit hospital systems.... No offense, but this proposal is essentially DOA.
- austhrow743 7y ago
  Creating oil spills isn't illegal and can't be if you want to get oil. Different scenarios. As for size of fish, we don't go "why is theft illegal when there are murderers still roaming around?" We can have both be illegal.
  - mbesto 7y ago
    My point is that we very rarely give criminal sentences to corporate executives in the US. This seems like an odd one to start with.

mbesto 7y ago

But doesn't eliminate hackers who do this type of stuff for the "lulz" (and if anything, makes it worse and potential a weapon for people who want to promote larger government). I understand the general premise of the proposal, but it's not a fool-proof check on game theory.

ikeboy 7y ago
It doesn't completely solve the problem, no. But the stories of hospitals and other entities paying non-trivial sums in ransom I would expect are mostly professional criminals, not hackers doing it for lulz.

jb775 7y ago

For conversation's sake, what if the victim is a small/mid-size business where the entire business would be destroyed in the event their systems are not unlocked immediately? Do they choose between possible prison time or definite loss of everything? Enforcing a fine relative to the ransom paid (and maybe relative to the "if we wouldn't have paid it" severity) is probably a good immediate start. This would at least galvanize businesses to improve existing security.

austhrow743 7y ago
Small businesses would have been destroyed by all sorts of rules that have already been passed. Companies whose entire service was dumping asbestos in to lakes or companies who only managed to turn a profit by hiring child labour. Their owners had to choose between possible jail time or losing everything. Every single thing done by a government, or really just any large player in the market place, is going to have small businesses that get flattened by it. That your entire company could be wiped out by changes in the marketplace, including laws, is one of the risks a person assumes when they decide to start a small business instead of working as an employee. They're earning their slice of the money pie in part by assuming that risk.

A_Parr 7y ago

Can you prove you didn't pay?