5 ms·

To be honest, just how bad of a thing is this? It’s a direct financial punishment for a company with lax security practices. It encourages greater security prac

by dannyw 6y ago

To be honest, just how bad of a thing is this? It’s a direct financial punishment for a company with lax security practices. It encourages greater security practices. The money is funnelled to a criminal group, but what difference does it make? Some people consider the USG to be a criminal group; many people are out on the streets for that. My tax dollars directly go to corrupt crooks and nonexistent companies claiming billions for nonexistent PPE. As a member of society, I don’t care if I’m paying a professional ransomware group, or a professional corruption gang.

ryan_j_naughton 6y ago
> It’s a direct financial punishment for a company with lax security practices. It encourages greater security practices. That argument could be used to justify any theft or even kidnapping. I know many people who grew up in countries where kidnapping was a very real concern. Consequently, they had to adopt "greater security practices" and it had a very real, negative effect on their lives. There are real harms to randomware. Companies go out of business, people lose their jobs, people lose their service providers, etc. To say, "it serves them right for not following proper security" literally can be said for a mom/pop business in a poor neighborhood who didn't have bulletproof glass or bars on their windows. It is negating the fact that (a) the harms are very real and (b) security costs money and resources, which is effectively another tax on their business. If instead the government made it illegal to pay such ransoms and actively audited large BTC transactions and charged people accordingly, then we could get rid of the incentives to do this in the first place. The government should similarly hold firms accountable when they are hacked (due to the harms on consumers) and require prompt disclosure of any hacks. There are ways to incentivize the preferred outcomes without supporting the active theft of property and destruction of someone's business.
- scrollaway 6y ago
  Physical and digital security aren't the same thing. There's no such thing as "this website is in a bad internet neighbourhood and should take extra precautions". I get where you're coming from but you can't really just flat out say "you can justify kidnapping with the same logic". Like, no, you can't. Fully agreed the government should be the ones playing the role of incentivizing security, but you can't then go back and say that security takes time and money those companies should not have to spend. They should, regardless of who keeps them accountable for it...
- sumedh 6y ago
  > The government should similarly hold firms accountable when they are hacked What should the govt so when govt agencies get hacked?
- MattSayar 6y ago
  In addition, the company isn't the only victim in a ransomware attack, its customers are too. And does anyone really believe the hackers deleted the data off their own servers? They can easily double-dip by selling that information. It's valuable, so why would they delete it?
  - dannyw 6y ago
    Double dipping ruins the reputation of the hackers and future income potential.
frequentnapper 6y ago
I agree. It's a trade-off, especially if you're a startup or a company with a hot product trying to beat competitors to market. Security practices would translate to loss of opportunity, so maybe it's a worthwhile trade-off to pay 1% of the gained revenue to these kinds of threats as a company. Unless there are harsher penalties and victims start caring more (and are given more tools and power to punish the companies that make that trade-off), this situation will remain. But then again, this makes the barrier to entry even higher for newcomers and gives an unfair advantage to the entrenched players. Tragedy of the commons?
koolba 6y ago
> As a member of society, I don’t care if I’m paying a professional ransomware group, or a professional corruption gang. The kidnapping analogy makes for a better understanding of why paying ransoms is bad for everybody else. If kidnappers know, or really just think, that they’ll get paid, they’re more likely to kidnap and hold hostages. It’s not that companies are not solely responsible for their own lax security policies. It’s that incentivizing the exploiting of them is bad for society.
DownGoat 6y ago
It sucks for the people who got their personal information caught up in this. They do more than just encrypt your files, they typically siphon as much data as possible from the companies before they execute the ransom part.
onion2k 6y ago
It encourages greater security practices. I don't think it does. It puts a much more tangible value on security, which encourages businesses to do a risk analysis like 'Do we spend $1m on security every year, or accept that there's a 0.xxx probability of a $4.5m ransom every n years?' That cost base analysis is often used to reduce the value of things that aren't obvious profit centers.
benlumen 6y ago
> To be honest, just how bad of a thing is this? It’s a direct financial punishment for a company with lax security practices. It encourages greater security practices. I see your point but this is flat-out organized crime, extortion to be precise. How long will it be before we're all making protection payments to ransomware groups?
- markdown 6y ago
  What makes crime "organised"? There's no indication that this involved more than one thief.
  - stagger87 6y ago
    Organized crime has a specific meaning. Whether this particular outfit is one or more people has no bearing on the use of the term organized crime in this instance.
    - markdown 6y ago
      I asked: > What makes crime "organised"? Your answer is: > Organized crime has a specific meaning Well... what is it?
      - stagger87 6y ago
        Sorry, I didn't think you might not be able to search for it. Here's a link. https://en.m.wikipedia.org/wiki/Organized_crime https://en.m.wikipedia.org/wiki/Organized_crime
        markdown 6y ago
        The link says you're wrong, and that in fact you can't have organised crime without at least two people.
- usrusr 6y ago
  A difference to physical "protection" schemes is that the group you'd pay to might actually keep other groups out of what they consider their turf. Ransomware attacks are not geographically bound so I really doubt that similar structures would develop there. With growing numbers of ransomers demands just wouldn't stop until either the company runs out if money or security gets good enough to keep them out.

by dannyw 6y ago

ryan_j_naughton 6y ago

> It’s a direct financial punishment for a company with lax security practices. It encourages greater security practices. That argument could be used to justify any theft or even kidnapping. I know many people who grew up in countries where kidnapping was a very real concern. Consequently, they had to adopt "greater security practices" and it had a very real, negative effect on their lives. There are real harms to randomware. Companies go out of business, people lose their jobs, people lose their service providers, etc. To say, "it serves them right for not following proper security" literally can be said for a mom/pop business in a poor neighborhood who didn't have bulletproof glass or bars on their windows. It is negating the fact that (a) the harms are very real and (b) security costs money and resources, which is effectively another tax on their business. If instead the government made it illegal to pay such ransoms and actively audited large BTC transactions and charged people accordingly, then we could get rid of the incentives to do this in the first place. The government should similarly hold firms accountable when they are hacked (due to the harms on consumers) and require prompt disclosure of any hacks. There are ways to incentivize the preferred outcomes without supporting the active theft of property and destruction of someone's business.

scrollaway 6y ago
Physical and digital security aren't the same thing. There's no such thing as "this website is in a bad internet neighbourhood and should take extra precautions". I get where you're coming from but you can't really just flat out say "you can justify kidnapping with the same logic". Like, no, you can't. Fully agreed the government should be the ones playing the role of incentivizing security, but you can't then go back and say that security takes time and money those companies should not have to spend. They should, regardless of who keeps them accountable for it...
sumedh 6y ago
> The government should similarly hold firms accountable when they are hacked What should the govt so when govt agencies get hacked?
MattSayar 6y ago
In addition, the company isn't the only victim in a ransomware attack, its customers are too. And does anyone really believe the hackers deleted the data off their own servers? They can easily double-dip by selling that information. It's valuable, so why would they delete it?
- dannyw 6y ago
  Double dipping ruins the reputation of the hackers and future income potential.

frequentnapper 6y ago

I agree. It's a trade-off, especially if you're a startup or a company with a hot product trying to beat competitors to market. Security practices would translate to loss of opportunity, so maybe it's a worthwhile trade-off to pay 1% of the gained revenue to these kinds of threats as a company. Unless there are harsher penalties and victims start caring more (and are given more tools and power to punish the companies that make that trade-off), this situation will remain. But then again, this makes the barrier to entry even higher for newcomers and gives an unfair advantage to the entrenched players. Tragedy of the commons?

koolba 6y ago

> As a member of society, I don’t care if I’m paying a professional ransomware group, or a professional corruption gang. The kidnapping analogy makes for a better understanding of why paying ransoms is bad for everybody else. If kidnappers know, or really just think, that they’ll get paid, they’re more likely to kidnap and hold hostages. It’s not that companies are not solely responsible for their own lax security policies. It’s that incentivizing the exploiting of them is bad for society.

DownGoat 6y ago

It sucks for the people who got their personal information caught up in this. They do more than just encrypt your files, they typically siphon as much data as possible from the companies before they execute the ransom part.

onion2k 6y ago

It encourages greater security practices. I don't think it does. It puts a much more tangible value on security, which encourages businesses to do a risk analysis like 'Do we spend $1m on security every year, or accept that there's a 0.xxx probability of a $4.5m ransom every n years?' That cost base analysis is often used to reduce the value of things that aren't obvious profit centers.

benlumen 6y ago

> To be honest, just how bad of a thing is this? It’s a direct financial punishment for a company with lax security practices. It encourages greater security practices. I see your point but this is flat-out organized crime, extortion to be precise. How long will it be before we're all making protection payments to ransomware groups?

markdown 6y ago
What makes crime "organised"? There's no indication that this involved more than one thief.
- stagger87 6y ago
  Organized crime has a specific meaning. Whether this particular outfit is one or more people has no bearing on the use of the term organized crime in this instance.
  - markdown 6y ago
    I asked: > What makes crime "organised"? Your answer is: > Organized crime has a specific meaning Well... what is it?
    - stagger87 6y ago
      Sorry, I didn't think you might not be able to search for it. Here's a link. https://en.m.wikipedia.org/wiki/Organized_crime https://en.m.wikipedia.org/wiki/Organized_crime
      - markdown 6y ago
        The link says you're wrong, and that in fact you can't have organised crime without at least two people.
usrusr 6y ago
A difference to physical "protection" schemes is that the group you'd pay to might actually keep other groups out of what they consider their turf. Ransomware attacks are not geographically bound so I really doubt that similar structures would develop there. With growing numbers of ransomers demands just wouldn't stop until either the company runs out if money or security gets good enough to keep them out.