4 ms·

Ransom probably isn’t the right term, it’s more like extortion. Failing to pay is hardly the moral high ground. It’s just the least expensive option. Businesses

Ransom probably isn’t the right term, it’s more like extortion. Failing to pay is hardly the moral high ground. It’s just the least expensive option. Businesses aren’t held accountable for their breeches by the US justice system and so facing the courts and captive customers/staff is the cheap and easy way out.

waynecochran 6y ago
Morality aside, the right thing to do is not pay them. That is the only move to win in the long run.
- klysm 6y ago
  That arguably depends on the data, but obviously you can’t trust them to give you the keys if you pay.
  - jtchang 6y ago
    This is true but the reality is that 99% of the time the hackers will abide by their word. There really isn't much for them to release the data after taking the ransom. It makes it much harder for future people to pay up.
    - Jon_Lowtek 6y ago
      I found no source that claims anything even close to 99%. For example, CyberEdges CDR [1] says the chance is ~66%, and has increased in recent years from 50%. Sure the narrative that "ransomware relies on customer satisfaction" is funny, but it is also wrong. Do not assume that criminals are honest people. Out of three, one does not care about the long term sustainability of their business model. https://cyber-edge.com/wp-content/uploads/2020/03/CyberEdge-2020-CDR-Report-v1.0.pdf https://cyber-edge.com/wp-content/uploads/2020/03/CyberEdge-...
  - waynecochran 6y ago
    Even if you get all your data back, you now have created incentive for folks to keep doing this. We all lose in the long term.
- lopmotr 6y ago
  Isn't that morality though? Doing what's best for the greater good even if it's against their immediate interests?
  - waynecochran 6y ago
    Winning is orthogonal to morality. In fact, one can "win" by some measures (e.g., make money) by means that are wrong.
- Anon1096 6y ago
  At least at my company, ransomware payments are covered by insurance so it's always worth it to pay and have a pretty good chance at getting our data back.
  - waynecochran 6y ago
    This is short term thinking .. most people think this way.
    - heretoo 6y ago
      Are you saying that short term thinking has no utility? I am willing to bet that there are a multitude of circumstances in most peoples lives that require short term thinking, or their lively hood or lives will be destroyed. In a threatening situation, you solve the short term problem in order to have an opportunity to think long term, which will help to prevent these problems subsequently. If we were talking chess, you wouldn't ignore the immediate moves of your opponent, because their idea of how the game should be played doesn't fit with your long term desire of how you want the game to turn out.
      - waynecochran 6y ago
        Perhaps I am a little too glib. You are correct, often without the short term there is no long term -- especially for small businesses. But as a whole, if institutions pay ransom then there is an incentive for folks to carry out this kind of extortion.
  - tashoecraft 6y ago
    The problem with the equation is it doesn’t include the individual who had their data stolen. If the school didn’t properly construct itself to code and I got hurt inside of it, I can sue. But if my data was stolen and my credit is destroyed I don’t have an option (I haven’t heard of anyone claiming this, but it could be true and idk). We need laws out in place to treat human data as someone’s property. If your data is mishandled with negligence and you experience provable hardship, there should be repercussions just like any other situation.
- dmos62 6y ago
  Morality is a set of rules about what's right and wrong. I'd say that we won't win or lose depending on whether we pay or don't pay. Root of the problem is legislature and regulation that allows infrastructure to be badly maintained without tangible repercussions. If you make a school not-thunder-proof and it burns down during a thunder storm, how's that different from a ransomware attack that abuses an unmaintained X? Because blaming thunder is foolish, but blaming a hacker is understandable? That could be a source of some of the confusion.

waynecochran 6y ago

Morality aside, the right thing to do is not pay them. That is the only move to win in the long run.

klysm 6y ago
That arguably depends on the data, but obviously you can’t trust them to give you the keys if you pay.
- jtchang 6y ago
  This is true but the reality is that 99% of the time the hackers will abide by their word. There really isn't much for them to release the data after taking the ransom. It makes it much harder for future people to pay up.
  - Jon_Lowtek 6y ago
    I found no source that claims anything even close to 99%. For example, CyberEdges CDR [1] says the chance is ~66%, and has increased in recent years from 50%. Sure the narrative that "ransomware relies on customer satisfaction" is funny, but it is also wrong. Do not assume that criminals are honest people. Out of three, one does not care about the long term sustainability of their business model. https://cyber-edge.com/wp-content/uploads/2020/03/CyberEdge-2020-CDR-Report-v1.0.pdf https://cyber-edge.com/wp-content/uploads/2020/03/CyberEdge-...
- waynecochran 6y ago
  Even if you get all your data back, you now have created incentive for folks to keep doing this. We all lose in the long term.
lopmotr 6y ago
Isn't that morality though? Doing what's best for the greater good even if it's against their immediate interests?
- waynecochran 6y ago
  Winning is orthogonal to morality. In fact, one can "win" by some measures (e.g., make money) by means that are wrong.
Anon1096 6y ago
At least at my company, ransomware payments are covered by insurance so it's always worth it to pay and have a pretty good chance at getting our data back.
- waynecochran 6y ago
  This is short term thinking .. most people think this way.
  - heretoo 6y ago
    Are you saying that short term thinking has no utility? I am willing to bet that there are a multitude of circumstances in most peoples lives that require short term thinking, or their lively hood or lives will be destroyed. In a threatening situation, you solve the short term problem in order to have an opportunity to think long term, which will help to prevent these problems subsequently. If we were talking chess, you wouldn't ignore the immediate moves of your opponent, because their idea of how the game should be played doesn't fit with your long term desire of how you want the game to turn out.
    - waynecochran 6y ago
      Perhaps I am a little too glib. You are correct, often without the short term there is no long term -- especially for small businesses. But as a whole, if institutions pay ransom then there is an incentive for folks to carry out this kind of extortion.
- tashoecraft 6y ago
  The problem with the equation is it doesn’t include the individual who had their data stolen. If the school didn’t properly construct itself to code and I got hurt inside of it, I can sue. But if my data was stolen and my credit is destroyed I don’t have an option (I haven’t heard of anyone claiming this, but it could be true and idk). We need laws out in place to treat human data as someone’s property. If your data is mishandled with negligence and you experience provable hardship, there should be repercussions just like any other situation.
dmos62 6y ago
Morality is a set of rules about what's right and wrong. I'd say that we won't win or lose depending on whether we pay or don't pay. Root of the problem is legislature and regulation that allows infrastructure to be badly maintained without tangible repercussions. If you make a school not-thunder-proof and it burns down during a thunder storm, how's that different from a ransomware attack that abuses an unmaintained X? Because blaming thunder is foolish, but blaming a hacker is understandable? That could be a source of some of the confusion.