3 ms·

It's a pretty legit business model; just because it's illegal doesn't necessarily mean the government wants to go after them. "Focused on paying illegal ransoms

It's a pretty legit business model; just because it's illegal doesn't necessarily mean the government wants to go after them. "Focused on paying illegal ransoms" = "allows companies to recover from devastating attacks by being a middle-man for paying the extortion fee and getting the decryption keys". It's probably one of those things that the government tells people not to do, but acknowledges is inevitable in many cases. A company I worked at once had a meeting with such a firm, and it all sounded pretty reasonable to me. Obviously, one would hope the company has backups (which are stored in a place that can't itself become encrypted), but if they don't, sometimes the cost of paying the ransom is far, far lower than the cost of staying down. These middle-man firms have probably saved companies from enormous amounts of damage. Another commenter claimed these companies are often in cahoots with the ransomers, which maybe is sometimes true, but I highly doubt it in the case of the company we dealt with, or other US-based companies with physical locations that meet on-site. Of course in an ideal world no one wants to reward criminals, but just to give an extreme example, if someone kidnapped one of your children and held them hostage, you'd probably pay anything to get them back, and that's not far off from the situation some ransomware-affected companies end up in.

Dahoon 6y ago
When most of them are from a little connected with the hackers to basically the same people and live off of ransoms I wouldn't use words like Pretty legit. I'm sure the exact business you have worked with is very different, in your opinion. I'm also sure everyone says that. I doubt a single of these businesses exists that isn't connected to hackers at all. How about a name if you are sure and we'll see?
- meowface 6y ago
  What are you basing any of this on? Can you show a single example of an American company that this applies to? The onus is on you to substantiate the claim in the first place, not on me to prove innocence.
the8472 6y ago
> Of course in an ideal world no one wants to reward criminals, but just to give an extreme example, if someone kidnapped one of your children and held them hostage, you'd probably pay anything to get them back, and that's not far off from the situation some ransomware-affected companies end up in. That's an appeal to emotion though while a company can do a cost-benefit analysis. Also, if you pay for your children that means you signal that the kidnapping business model is viable and thus endanger more children. If the government keeps you at gunpoint from paying for your children then yes, in the worst case a bunch of children might die, but the business model would die with them.
- jdkrkrkf 6y ago
  The reason kidnappings are not a thing in US is that the government will go after and get the kidnappers even after the payment is made.
- pessimizer 6y ago
  No, in the worst case the government would shoot the parents of kidnapped children, and lose its legitimacy in the eyes of the people who it governs. There's no case in which a government would be able to continue to do that with impunity until enough children die to convince every potential kidnapper that kidnapping is a hopeless business.
- meowface 6y ago
  Right, which is why this is always done as part of a cost-benefit analysis. Sometimes the cost of not paying is far greater. And yes, paying the ransom signals that hostage-taking can be profitable, but not paying it signals that you value crime prevention over the lives of your children, which isn't necessarily a reputation or circumstance you want, especially when they'll very likely end up brutally murdered. A company that decided principle-based crime deterrence was more important than granting customers access to any of their funds for 6 months would probably go out of business quickly. Also, try using that argument when talking to people who live in areas largely run by organized crime.

Dahoon 6y ago

When most of them are from a little connected with the hackers to basically the same people and live off of ransoms I wouldn't use words like Pretty legit. I'm sure the exact business you have worked with is very different, in your opinion. I'm also sure everyone says that. I doubt a single of these businesses exists that isn't connected to hackers at all. How about a name if you are sure and we'll see?

meowface 6y ago
What are you basing any of this on? Can you show a single example of an American company that this applies to? The onus is on you to substantiate the claim in the first place, not on me to prove innocence.

the8472 6y ago

> Of course in an ideal world no one wants to reward criminals, but just to give an extreme example, if someone kidnapped one of your children and held them hostage, you'd probably pay anything to get them back, and that's not far off from the situation some ransomware-affected companies end up in. That's an appeal to emotion though while a company can do a cost-benefit analysis. Also, if you pay for your children that means you signal that the kidnapping business model is viable and thus endanger more children. If the government keeps you at gunpoint from paying for your children then yes, in the worst case a bunch of children might die, but the business model would die with them.

jdkrkrkf 6y ago
The reason kidnappings are not a thing in US is that the government will go after and get the kidnappers even after the payment is made.
pessimizer 6y ago
No, in the worst case the government would shoot the parents of kidnapped children, and lose its legitimacy in the eyes of the people who it governs. There's no case in which a government would be able to continue to do that with impunity until enough children die to convince every potential kidnapper that kidnapping is a hopeless business.
meowface 6y ago
Right, which is why this is always done as part of a cost-benefit analysis. Sometimes the cost of not paying is far greater. And yes, paying the ransom signals that hostage-taking can be profitable, but not paying it signals that you value crime prevention over the lives of your children, which isn't necessarily a reputation or circumstance you want, especially when they'll very likely end up brutally murdered. A company that decided principle-based crime deterrence was more important than granting customers access to any of their funds for 6 months would probably go out of business quickly. Also, try using that argument when talking to people who live in areas largely run by organized crime.