5 ms·

Nothing will change until they make it a felony to pay a ransom.

trianglem 6y ago
Impossible. Some things are just worth more than any amount of money and punishing the victim will not change that.
hn_throwaway_99 6y ago
At the very least they should require full disclosure, including an analysis of how the hackers were able to breach their systems. I believe that some laws requiring notification to customers in case of a data breach would already cover this. However, from another article I found this statement from CWT: "While the investigation is at an early stage, we have no indication that personally identifiable information/customer and traveller information has been compromised." That appears to be a complete lie based on the chat transcripts, and if so I hope CWT is punished legally for it.
baddox 6y ago
Isn’t it already a felony to attack computer systems and hold data for ransom? That doesn’t seem to be working flawlessly.
- ric2b 6y ago
  Yes, but the affected company is the one paying the ransom. Make that a felony and suddenly their choice is to invest in security or risk having their business halted for potentially months.
  - baddox 6y ago
    Or, pay ransoms secretly, which is of course what companies would do.
mytailorisrich 6y ago
I'm sure criminals would like that. Victims would still have an incentive to pay, but also an incentive not to say anything.
pjc50 6y ago
Given that the alternative is usually the business folding, I don't think this is likely to happen. Edit: also, I don't think that making getting hacked more onerous while keeping software developers completely legally immune from liability for the software getting hacked would be politically sustainable either...
synsynack 6y ago
Easy to go around that, companies will just pay an offshore company that can recover the decryption key (and they do so by using part of what you pay them to pay the ransom)
pc86 6y ago
On what grounds would you make a monetary transfer like this illegal? Why a felony? What's the punishment? Who gets punished when a public company does it? You can't charge a company with a felony (usually). What about a private company? LLC? Sole proprietorship? What about my laptop, can I pay a $1000 ransom for that?
- 0x00000000 6y ago
  I guess same as violating economic sanctions since it is similarly funding a group that is by definition hostile to the US’s economic interests.
tatersolid 6y ago
> Nothing will change until they make it a felony to pay a ransom. It already is a felony to pay ransomware attackers in the US, depending on who attacked you. Many of the principal ransomware gangs are listed as OFAC [1] restricted entities. If you pay them, even indirectly, you are as criminally culpable as if you sent sponsor dollars to ISIS or another terrorist or organized crime entity. Garmin’s execs are in for a big surprise when the Treasury agents come to visit. [1]: https://en.wikipedia.org/wiki/Office_of_Foreign_Assets_Control https://en.wikipedia.org/wiki/Office_of_Foreign_Assets_Contr...

Impossible. Some things are just worth more than any amount of money and punishing the victim will not change that.

At the very least they should require full disclosure, including an analysis of how the hackers were able to breach their systems. I believe that some laws requiring notification to customers in case of a data breach would already cover this. However, from another article I found this statement from CWT: "While the investigation is at an early stage, we have no indication that personally identifiable information/customer and traveller information has been compromised." That appears to be a complete lie based on the chat transcripts, and if so I hope CWT is punished legally for it.

baddox 6y ago

Isn’t it already a felony to attack computer systems and hold data for ransom? That doesn’t seem to be working flawlessly.

ric2b 6y ago
Yes, but the affected company is the one paying the ransom. Make that a felony and suddenly their choice is to invest in security or risk having their business halted for potentially months.
- baddox 6y ago
  Or, pay ransoms secretly, which is of course what companies would do.

mytailorisrich 6y ago

I'm sure criminals would like that. Victims would still have an incentive to pay, but also an incentive not to say anything.

pjc50 6y ago

Given that the alternative is usually the business folding, I don't think this is likely to happen. Edit: also, I don't think that making getting hacked more onerous while keeping software developers completely legally immune from liability for the software getting hacked would be politically sustainable either...

synsynack 6y ago

Easy to go around that, companies will just pay an offshore company that can recover the decryption key (and they do so by using part of what you pay them to pay the ransom)

pc86 6y ago

On what grounds would you make a monetary transfer like this illegal? Why a felony? What's the punishment? Who gets punished when a public company does it? You can't charge a company with a felony (usually). What about a private company? LLC? Sole proprietorship? What about my laptop, can I pay a $1000 ransom for that?

0x00000000 6y ago
I guess same as violating economic sanctions since it is similarly funding a group that is by definition hostile to the US’s economic interests.

tatersolid 6y ago

> Nothing will change until they make it a felony to pay a ransom. It already is a felony to pay ransomware attackers in the US, depending on who attacked you. Many of the principal ransomware gangs are listed as OFAC [1] restricted entities. If you pay them, even indirectly, you are as criminally culpable as if you sent sponsor dollars to ISIS or another terrorist or organized crime entity. Garmin’s execs are in for a big surprise when the Treasury agents come to visit. [1]: https://en.wikipedia.org/wiki/Office_of_Foreign_Assets_Control https://en.wikipedia.org/wiki/Office_of_Foreign_Assets_Contr...